mirror of
https://github.com/openjdk/jdk.git
synced 2025-08-26 06:14:49 +02:00
8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
Reviewed-by: mullan
This commit is contained in:
Mark Powers
parent
dec93675ab
commit
907350e9e8
8 changed files with 392 additions and 4 deletions
|
|
@ -1,5 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
|
||||
* Copyright (c) 2018, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
|
|
@ -67,6 +67,22 @@ enum CADistrustPolicy {
|
|||
}
|
||||
EntrustTLSPolicy.checkDistrust(chain);
|
||||
}
|
||||
},
|
||||
|
||||
/**
|
||||
* Distrust TLS Server certificates anchored by a CAMERFIRMA root CA and
|
||||
* issued after April 15, 2025. If enabled, this policy is currently
|
||||
* enforced by the PKIX and SunX509 TrustManager implementations
|
||||
* of the SunJSSE provider implementation.
|
||||
*/
|
||||
CAMERFIRMA_TLS {
|
||||
void checkDistrust(String variant, X509Certificate[] chain)
|
||||
throws ValidatorException {
|
||||
if (!variant.equals(Validator.VAR_TLS_SERVER)) {
|
||||
return;
|
||||
}
|
||||
CamerfirmaTLSPolicy.checkDistrust(chain);
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -0,0 +1,114 @@
|
|||
/*
|
||||
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation. Oracle designates this
|
||||
* particular file as subject to the "Classpath" exception as provided
|
||||
* by Oracle in the LICENSE file that accompanied this code.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
package sun.security.validator;
|
||||
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.time.LocalDate;
|
||||
import java.time.Month;
|
||||
import java.time.ZoneOffset;
|
||||
import java.util.Date;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
import sun.security.util.Debug;
|
||||
import sun.security.x509.X509CertImpl;
|
||||
|
||||
/**
|
||||
* This class checks if Camerfirma issued TLS Server certificates should be
|
||||
* restricted.
|
||||
*/
|
||||
final class CamerfirmaTLSPolicy {
|
||||
|
||||
private static final Debug debug = Debug.getInstance("certpath");
|
||||
|
||||
// SHA-256 certificate fingerprints of distrusted roots
|
||||
private static final Set<String> FINGERPRINTS = Set.of(
|
||||
// cacerts alias: camerfirmachamberscommerceca
|
||||
// DN: CN=Chambers of Commerce Root,
|
||||
// OU=http://www.chambersign.org,
|
||||
// O=AC Camerfirma SA CIF A82743287, C=EU
|
||||
"0C258A12A5674AEF25F28BA7DCFAECEEA348E541E6F5CC4EE63B71B361606AC3",
|
||||
// cacerts alias: camerfirmachambersca
|
||||
// DN: CN=Chambers of Commerce Root - 2008,
|
||||
// O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
|
||||
// L=Madrid (see current address at www.camerfirma.com/address),
|
||||
// C=EU
|
||||
"063E4AFAC491DFD332F3089B8542E94617D893D7FE944E10A7937EE29D9693C0",
|
||||
// cacerts alias: camerfirmachambersignca
|
||||
// DN: CN=Global Chambersign Root - 2008,
|
||||
// O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
|
||||
// L=Madrid (see current address at www.camerfirma.com/address),
|
||||
// C=EU
|
||||
"136335439334A7698016A0D324DE72284E079D7B5220BB8FBD747816EEBEBACA"
|
||||
);
|
||||
|
||||
// Any TLS Server certificate that is anchored by one of the Camerfirma
|
||||
// roots above and is issued after this date will be distrusted.
|
||||
private static final LocalDate APRIL_15_2025 =
|
||||
LocalDate.of(2025, Month.APRIL, 15);
|
||||
|
||||
/**
|
||||
* This method assumes the eeCert is a TLS Server Cert and chains back to
|
||||
* the anchor.
|
||||
*
|
||||
* @param chain the end-entity's certificate chain. The end entity cert
|
||||
* is at index 0, the trust anchor at index n-1.
|
||||
* @throws ValidatorException if the certificate is distrusted
|
||||
*/
|
||||
static void checkDistrust(X509Certificate[] chain)
|
||||
throws ValidatorException {
|
||||
X509Certificate anchor = chain[chain.length-1];
|
||||
String fp = fingerprint(anchor);
|
||||
if (fp == null) {
|
||||
throw new ValidatorException("Cannot generate fingerprint for "
|
||||
+ "trust anchor of TLS server certificate");
|
||||
}
|
||||
if (FINGERPRINTS.contains(fp)) {
|
||||
Date notBefore = chain[0].getNotBefore();
|
||||
LocalDate ldNotBefore = LocalDate.ofInstant(notBefore.toInstant(),
|
||||
ZoneOffset.UTC);
|
||||
// reject if certificate is issued after April 15, 2025
|
||||
checkNotBefore(ldNotBefore, APRIL_15_2025, anchor);
|
||||
}
|
||||
}
|
||||
|
||||
private static String fingerprint(X509Certificate cert) {
|
||||
return X509CertImpl.getFingerprint("SHA-256", cert, debug);
|
||||
}
|
||||
|
||||
private static void checkNotBefore(LocalDate notBeforeDate,
|
||||
LocalDate distrustDate, X509Certificate anchor)
|
||||
throws ValidatorException {
|
||||
if (notBeforeDate.isAfter(distrustDate)) {
|
||||
throw new ValidatorException
|
||||
("TLS Server certificate issued after " + distrustDate +
|
||||
" and anchored by a distrusted legacy Camerfirma root CA: "
|
||||
+ anchor.getSubjectX500Principal(),
|
||||
ValidatorException.T_UNTRUSTED_CERT, anchor);
|
||||
}
|
||||
}
|
||||
|
||||
private CamerfirmaTLSPolicy() {}
|
||||
}
|
||||
|
|
@ -1318,6 +1318,9 @@ jdk.sasl.disabledMechanisms=
|
|||
# ENTRUST_TLS : Distrust TLS Server certificates anchored by
|
||||
# an Entrust root CA and issued after November 11, 2024.
|
||||
#
|
||||
# CAMERFIRMA_TLS : Distrust TLS Server certificates anchored by
|
||||
# a Camerfirma root CA and issued after April 15, 2025.
|
||||
#
|
||||
# Leading and trailing whitespace surrounding each value are ignored.
|
||||
# Unknown values are ignored. If the property is commented out or set to the
|
||||
# empty String, no policies are enforced.
|
||||
|
|
@ -1329,7 +1332,7 @@ jdk.sasl.disabledMechanisms=
|
|||
# jdk.certpath.disabledAlgorithms; those restrictions are still enforced even
|
||||
# if this property is not enabled.
|
||||
#
|
||||
jdk.security.caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS
|
||||
jdk.security.caDistrustPolicies=SYMANTEC_TLS,ENTRUST_TLS,CAMERFIRMA_TLS
|
||||
|
||||
#
|
||||
# FilePermission path canonicalization
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
/*
|
||||
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
import java.io.File;
|
||||
import java.security.Security;
|
||||
import java.time.*;
|
||||
import java.util.*;
|
||||
import javax.net.ssl.*;
|
||||
|
||||
/**
|
||||
* @test
|
||||
* @bug 8346587
|
||||
* @summary Check that TLS Server certificates chaining back to distrusted
|
||||
* Camerfirma roots are invalid
|
||||
* @library /test/lib
|
||||
* @modules java.base/sun.security.validator
|
||||
* @run main/othervm Camerfirma after policyOn invalid
|
||||
* @run main/othervm Camerfirma after policyOff valid
|
||||
* @run main/othervm Camerfirma before policyOn valid
|
||||
* @run main/othervm Camerfirma before policyOff valid
|
||||
*/
|
||||
|
||||
public class Camerfirma {
|
||||
|
||||
private static final String certPath = "chains" + File.separator + "camerfirma";
|
||||
|
||||
// Each of the roots have a test certificate chain stored in a file
|
||||
// named "<root>-chain.pem".
|
||||
private static String[] rootsToTest = new String[] {
|
||||
"camerfirmachamberscommerceca", "camerfirmachambersca",
|
||||
"camerfirmachambersignca"};
|
||||
|
||||
// Date after the restrictions take effect
|
||||
private static final ZonedDateTime DISTRUST_DATE =
|
||||
LocalDate.of(2025, 04, 16).atStartOfDay(ZoneOffset.UTC);
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
|
||||
// All of the test certificates are signed with SHA-1 so we need
|
||||
// to remove the constraint that disallows SHA-1 certificates.
|
||||
String prop = Security.getProperty("jdk.certpath.disabledAlgorithms");
|
||||
String newProp = prop.replace(", SHA1 jdkCA & usage TLSServer", "");
|
||||
Security.setProperty("jdk.certpath.disabledAlgorithms", newProp);
|
||||
|
||||
Distrust distrust = new Distrust(args);
|
||||
|
||||
X509TrustManager[] tms = new X509TrustManager[]{
|
||||
distrust.getTMF("PKIX", null),
|
||||
distrust.getTMF("SunX509", null)
|
||||
};
|
||||
|
||||
Date notBefore = distrust.getNotBefore(DISTRUST_DATE);
|
||||
distrust.testCertificateChain(certPath, notBefore, tms, rootsToTest);
|
||||
}
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
|
||||
* Copyright (c) 2024, 2025, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
|
|
@ -198,7 +198,13 @@ public final class Distrust {
|
|||
public boolean[] getSubjectUniqueID() {
|
||||
return cert.getSubjectUniqueID();
|
||||
}
|
||||
public boolean[] getKeyUsage() { return cert.getKeyUsage(); }
|
||||
public boolean[] getKeyUsage() {
|
||||
// Turn on the Digital Signature bit. Some certs that we want
|
||||
// to use as test certs don't have this bit turned on.
|
||||
boolean[] withDigitalSignature = cert.getKeyUsage();
|
||||
withDigitalSignature[0] = true;
|
||||
return withDigitalSignature;
|
||||
}
|
||||
public int getBasicConstraints() { return cert.getBasicConstraints(); }
|
||||
public byte[] getEncoded() throws CertificateEncodingException {
|
||||
return cert.getEncoded();
|
||||
|
|
|
|||
|
|
@ -0,0 +1,64 @@
|
|||
Owner: CN=Camerfirma Corporate Server II - 2015,
|
||||
L=Madrid (see current address at https://www.camerfirma.com/address),
|
||||
SERIALNUMBER=A82743287,
|
||||
O=AC Camerfirma S.A., OU=AC CAMERFIRMA, C=ES
|
||||
Issuer: CN=Chambers of Commerce Root - 2008,
|
||||
O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
|
||||
L=Madrid (see current address at www.camerfirma.com/address), C=EU
|
||||
Serial number: 621ff31c489ba136
|
||||
Valid from: Thu Jan 15 01:21:16 PST 2015 until: Tue Dec 15 01:21:16 PST 2037
|
||||
Certificate fingerprints:
|
||||
SHA1: FE:72:7A:78:EA:0C:03:35:CD:DA:9C:2E:D7:5F:D4:D4:6F:35:C2:EF
|
||||
SHA256: 66:EA:E2:70:9B:54:CD:D1:69:31:77:B1:33:2F:F0:36:CD:D0:F7:23:DB:30:39:ED:31:15:55:A6:CB:F5:FF:3E
|
||||
Signature algorithm name: SHA256withRSA
|
||||
Subject Public Key Algorithm: 4096-bit RSA key
|
||||
Version: 3
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIIkzCCBnugAwIBAgIIYh/zHEiboTYwDQYJKoZIhvcNAQELBQAwga4xCzAJBgNV
|
||||
BAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQg
|
||||
d3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIwEAYDVQQFEwlBODI3NDMyODcx
|
||||
GzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEpMCcGA1UEAxMgQ2hhbWJlcnMg
|
||||
b2YgQ29tbWVyY2UgUm9vdCAtIDIwMDgwHhcNMTUwMTE1MDkyMTE2WhcNMzcxMjE1
|
||||
MDkyMTE2WjCB0zELMAkGA1UEBhMCRVMxFjAUBgNVBAsMDUFDIENBTUVSRklSTUEx
|
||||
GzAZBgNVBAoMEkFDIENhbWVyZmlybWEgUy5BLjESMBAGA1UEBRMJQTgyNzQzMjg3
|
||||
MUswSQYDVQQHDEJNYWRyaWQgKHNlZSBjdXJyZW50IGFkZHJlc3MgYXQgaHR0cHM6
|
||||
Ly93d3cuY2FtZXJmaXJtYS5jb20vYWRkcmVzcykxLjAsBgNVBAMMJUNhbWVyZmly
|
||||
bWEgQ29ycG9yYXRlIFNlcnZlciBJSSAtIDIwMTUwggIiMA0GCSqGSIb3DQEBAQUA
|
||||
A4ICDwAwggIKAoICAQC3ndKNpFufVq9v+15dRoT9oVkgwEfDdsPw0Ly0R+eM5MOk
|
||||
35zEil/+hqEMbQmcvosAh6I8iAskkXasqh+SMbMIjvXbDyNILeGzsoP0uz3btHM7
|
||||
oN3yHXDhhd1NGNocP54Wehe9+RE3WP0yEEo+D2YmMwUHuv4KiXtveiPksv+Xkkz5
|
||||
auqppPMaYlD6y49AEsGY2zOEUI8PO4+tOxUKhvsiMuW817vH3VdmMwOjRe0SdYAi
|
||||
YLQIiyqJGNdEo3u+fw8UXxaJSRXhmF+jUn5DvdzWWNAxxwAKy95EPlpLQsx/7t2W
|
||||
2ntoELPHGJk4V+/yA0d2olLEqBADkRtP2HiC0wly+zp7OGmjtfjbqLrVjmo/mLP3
|
||||
zpmYbpUtubrHiY0rlW6wo5FZLcTUvcAxFjxLWVIELPjnTebOuHvoJTb97rhA1Oqq
|
||||
woq5FWJHFI9idzXzFLO0LX/4ugI9LZWxmvWW0O4CePtnhp0aNE/GgAw6lMx7bjZe
|
||||
DXxxQnUDEE/mAqOHRUCnvRUSKVbuBBE0oz5fz3nUwcWVVgrm/jkgqTX4EqnZe+yB
|
||||
mKV6hFEYV+1oVh7kzNN4Hg7nzGuByS7cCuBEwULFhfUja1Bu9EqgndJ3CV0XCWIA
|
||||
XVhJnPNPi6y4W11jLJ7XSGSz3sCh21g0Gpgi2pXHGDB65Jc/QJHZ5ZaHCrzFnwID
|
||||
AQABo4ICjDCCAogwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQUY+nw8FYA
|
||||
aGWwIWwOXNcZCJ0INGUwgeMGA1UdIwSB2zCB2IAU+SSsD7K1+HnA+mCIG8TZTQKe
|
||||
FxmhgbSkgbEwga4xCzAJBgNVBAYTAkVVMUMwQQYDVQQHEzpNYWRyaWQgKHNlZSBj
|
||||
dXJyZW50IGFkZHJlc3MgYXQgd3d3LmNhbWVyZmlybWEuY29tL2FkZHJlc3MpMRIw
|
||||
EAYDVQQFEwlBODI3NDMyODcxGzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjEp
|
||||
MCcGA1UEAxMgQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdCAtIDIwMDiCCQCj2kJ+
|
||||
pLGu2jB6BggrBgEFBQcBAQRuMGwwQgYIKwYBBQUHMAKGNmh0dHA6Ly93d3cuY2Ft
|
||||
ZXJmaXJtYS5jb20vY2VydHMvcm9vdF9jaGFtYmVycy0yMDA4LmNydDAmBggrBgEF
|
||||
BQcwAYYaaHR0cDovL29jc3AuY2FtZXJmaXJtYS5jb20wDgYDVR0PAQH/BAQDAgEG
|
||||
MCcGA1UdJQQgMB4GCCsGAQUFBwMEBggrBgEFBQcDAgYIKwYBBQUHAwEwPgYDVR0g
|
||||
BDcwNTAzBgRVHSAAMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vcG9saWN5LmNhbWVy
|
||||
ZmlybWEuY29tMHgGA1UdHwRxMG8wNaAzoDGGL2h0dHA6Ly9jcmwuY2FtZXJmaXJt
|
||||
YS5jb20vY2hhbWJlcnNyb290LTIwMDguY3JsMDagNKAyhjBodHRwOi8vY3JsMS5j
|
||||
YW1lcmZpcm1hLmNvbS9jaGFtYmVyc3Jvb3QtMjAwOC5jcmwwDQYJKoZIhvcNAQEL
|
||||
BQADggIBAKhqaZwalwf89f4wPqfcE/lrsHdx8+q9RG46ouBXhTJMqXjwstXOZSL4
|
||||
3Dqs3GaVuMPIM9OG7CK0I93mAt+FWtr49ACFTyPBxPg/knrZ4RHyEto+/6w0WZ9H
|
||||
owNw0aUg3ZAkhIvMRPVou8PrVukqj2lGKIh3hRdrbHwYwwmKKNlWBoC9gWk3mTYU
|
||||
zfNt/KTzQCCl5+s6YDa+XInMLWaGd/pE/e++a22vY24cv7kN3NAFMjAMELPwh9ic
|
||||
zLoPX8B52r+GgwpKY0c0hZdVTii6psLQ+BenyMlh+6lHRBOlTCSRtNi16o7H8fRq
|
||||
CY2wyQi7N+EmdY1DhvECCi1nLbOnIx1bSAW0cVwPVrjQ/vsAxPNc3SGe/Xnanm3a
|
||||
zAgFspzeuAhxxG0VKOvtPBnPQNsQ0cK664+IrWRsfa6aYhEfKvfsn5o4HpBWDobf
|
||||
zrtNbqjjOuiM6JkT+DxXo5UK7t2q75KCJiimTtAuPcZ5wErZISLvZ34BodIHL2xK
|
||||
b3Vww7K2FE1QaNsuQkGbUk++B9/+vV3H57vzskObdFWeWKSCpxIil4vZwIIH17zn
|
||||
WU+O2WIY1F0aO9zp3E7qwfmYT4MJ38NF9R7FSlxRlgVc1uUHu/iyUU4N1O6F3VdX
|
||||
P2Y+tgLFZLYV4kApfXk5l9h94dgKyfVcIpvS6yVpLfONPnlCNOxy
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
Owner: CN=AC Camerfirma Certificados Camerales,
|
||||
O=AC Camerfirma SA, SERIALNUMBER=A82743287,
|
||||
L=Madrid (see current address at www.camerfirma.com/address),
|
||||
EMAILADDRESS=ac_camerfirma_cc@camerfirma.com, C=ES
|
||||
Issuer: CN=Chambers of Commerce Root, OU=http://www.chambersign.org,
|
||||
O=AC Camerfirma SA CIF A82743287, C=EU
|
||||
Serial number: 5
|
||||
Valid from: Mon Feb 09 07:42:47 PST 2004 until: Thu Feb 09 07:42:47 PST 2034
|
||||
Certificate fingerprints:
|
||||
SHA1: 9F:36:B4:BE:9D:AF:1C:91:01:B2:D7:61:58:FB:95:CB:53:82:01:10
|
||||
SHA256: C7:D8:43:81:E1:1F:7C:57:46:77:1A:F5:B0:50:DC:51:FC:6F:DA:D6:F6:F3:5B:B5:3A:3D:E9:13:82:2E:A0:9E
|
||||
Signature algorithm name: SHA1withRSA (weak)
|
||||
Subject Public Key Algorithm: 2048-bit RSA key
|
||||
Version: 3
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFwDCCBKigAwIBAgIBBTANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJFVTEn
|
||||
MCUGA1UEChMeQUMgQ2FtZXJmaXJtYSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQL
|
||||
ExpodHRwOi8vd3d3LmNoYW1iZXJzaWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMg
|
||||
b2YgQ29tbWVyY2UgUm9vdDAeFw0wNDAyMDkxNTQyNDdaFw0zNDAyMDkxNTQyNDda
|
||||
MIHgMQswCQYDVQQGEwJFUzEuMCwGCSqGSIb3DQEJARYfYWNfY2FtZXJmaXJtYV9j
|
||||
Y0BjYW1lcmZpcm1hLmNvbTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3VycmVudCBh
|
||||
ZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAGA1UEBRMJ
|
||||
QTgyNzQzMjg3MRkwFwYDVQQKExBBQyBDYW1lcmZpcm1hIFNBMS0wKwYDVQQDEyRB
|
||||
QyBDYW1lcmZpcm1hIENlcnRpZmljYWRvcyBDYW1lcmFsZXMwggEgMA0GCSqGSIb3
|
||||
DQEBAQUAA4IBDQAwggEIAoIBAQCjxnvvj01f36lgGhihRYVf1fAPEXsTJKrY4aLQ
|
||||
cEUSh5szZE7VTtGiyMTMc2uCmnaXafjYHK8Lgmy6T9xxGEZ5OS4x6rgtuPyy13AP
|
||||
tu3X3Y2kPVLu7ZMw5HoQC64wBj6YcnxTnBwmVW05DjzRXp6OyBIEKEaAB9vv2qEl
|
||||
fh/Y234FG6Wd/ut1s0ScRZAo+6CSMNQxaY+ryXKD11uWkzWXJa9UZOasG7z4uPqc
|
||||
Gr4/Hz2/CTLDTgp0xkMJYuzOztpUvOACrxlkS2utKUwVlAikJnboNwf/en94RbHN
|
||||
zkKc5t0SAbzCf57ueawbzxSdPa+SAC25FNur64FKkfdq5PPjAgEDo4IB5TCCAeEw
|
||||
EgYDVR0TAQH/BAgwBgEB/wIBCzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3Js
|
||||
LmNoYW1iZXJzaWduLm9yZy9jaGFtYmVyc3Jvb3QuY3JsMB0GA1UdDgQWBBS2H06d
|
||||
HGiRLjdyYOFGj1qlKjExuTCBqwYDVR0jBIGjMIGggBTjlPWxTenboSlbV4tNdgZ2
|
||||
4dGiiqGBhKSBgTB/MQswCQYDVQQGEwJFVTEnMCUGA1UEChMeQUMgQ2FtZXJmaXJt
|
||||
YSBTQSBDSUYgQTgyNzQzMjg3MSMwIQYDVQQLExpodHRwOi8vd3d3LmNoYW1iZXJz
|
||||
aWduLm9yZzEiMCAGA1UEAxMZQ2hhbWJlcnMgb2YgQ29tbWVyY2UgUm9vdIIBADAO
|
||||
BgNVHQ8BAf8EBAMCAYYwKgYDVR0RBCMwIYEfYWNfY2FtZXJmaXJtYV9jY0BjYW1l
|
||||
cmZpcm1hLmNvbTAnBgNVHRIEIDAegRxjaGFtYmVyc3Jvb3RAY2hhbWJlcnNpZ24u
|
||||
b3JnMFsGA1UdIARUMFIwUAYLKwYBBAGBhy4KCQEwQTA/BggrBgEFBQcCARYzaHR0
|
||||
cDovL2Nwcy5jYW1lcmZpcm1hLmNvbS9jcHMvYWNfY2FtZXJmaXJtYV9jYy5odG1s
|
||||
MA0GCSqGSIb3DQEBBQUAA4IBAQBl8KoPBYL//EBonqQWS0N+hLfxImP1eQ6nac+v
|
||||
R5QfF/0w+VCTkShfKwHaa6V/W1dPlVwXSECuvXHkX6DYrtxFGGFB6qxuP1rkIpRs
|
||||
sTkAlpvOx3REiFjIkhsijKd/ijvqxjbMbuYU+EFACK/jQIRoj+LEEZ+haiqbALZB
|
||||
Iqq/26HTqX0itDosBj6M94YWcIpbTDefQNWCGsSnZcw2+k+az/wAOZT6xAxlnEim
|
||||
HpDDlgRsmaLrHpDPDoIRYOih0gbJTnn4mKex9Wgr0sZ+XFl03j+bvcXL1tiuQnwb
|
||||
9dMRDe/OdXABT35W4ZzLbpost65ZW3Tx+oi/bLbmu6pbKCgs
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,62 @@
|
|||
Owner: CN=AC Camerfirma - 2009,
|
||||
L=Madrid (see current address at https://www.camerfirma.com/address),
|
||||
SERIALNUMBER=A82743287, O=AC Camerfirma S.A., C=ES
|
||||
Issuer: CN=Global Chambersign Root - 2008,
|
||||
O=AC Camerfirma S.A., SERIALNUMBER=A82743287,
|
||||
L=Madrid (see current address at www.camerfirma.com/address), C=EU
|
||||
Serial number: 2
|
||||
Valid from: Mon Mar 16 10:16:25 PDT 2009 until: Sun Mar 11 10:16:25 PDT 2029
|
||||
Certificate fingerprints:
|
||||
SHA1: BA:BA:69:CF:D5:CC:C9:4D:05:6B:5B:E7:80:5F:E2:03:CB:EB:5C:57
|
||||
SHA256: B6:8D:5D:9B:4E:A6:35:95:7C:0C:32:15:C2:0D:35:B2:21:7B:69:E3:49:C7:A3:04:C4:F9:7F:20:C4:08:1F:88
|
||||
Signature algorithm name: SHA1withRSA (weak)
|
||||
Subject Public Key Algorithm: 4096-bit RSA key
|
||||
Version: 3
|
||||
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIIPzCCBiegAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBrDELMAkGA1UEBhMCRVUx
|
||||
QzBBBgNVBAcTOk1hZHJpZCAoc2VlIGN1cnJlbnQgYWRkcmVzcyBhdCB3d3cuY2Ft
|
||||
ZXJmaXJtYS5jb20vYWRkcmVzcykxEjAQBgNVBAUTCUE4Mjc0MzI4NzEbMBkGA1UE
|
||||
ChMSQUMgQ2FtZXJmaXJtYSBTLkEuMScwJQYDVQQDEx5HbG9iYWwgQ2hhbWJlcnNp
|
||||
Z24gUm9vdCAtIDIwMDgwHhcNMDkwMzE2MTcxNjI1WhcNMjkwMzExMTcxNjI1WjCB
|
||||
qjELMAkGA1UEBhMCRVMxGzAZBgNVBAoTEkFDIENhbWVyZmlybWEgUy5BLjESMBAG
|
||||
A1UEBRMJQTgyNzQzMjg3MUswSQYDVQQHE0JNYWRyaWQgKHNlZSBjdXJyZW50IGFk
|
||||
ZHJlc3MgYXQgaHR0cHM6Ly93d3cuY2FtZXJmaXJtYS5jb20vYWRkcmVzcykxHTAb
|
||||
BgNVBAMTFEFDIENhbWVyZmlybWEgLSAyMDA5MIICIjANBgkqhkiG9w0BAQEFAAOC
|
||||
Ag8AMIICCgKCAgEAmbHxFEYTJmMdPcYiPlWUGZu2+tQo4voohYi3dwCwoVuGdHSp
|
||||
kyoqs1B3YGx4u5KT4n0A7+Bb8YQ/QzbNy7UQ4JXAK+rT8JpNeKIvfN4lHnQJaChE
|
||||
4fdn0KpvHWymaNq2k+EbQClquZB6OsTLvsivwSuSnyLcUw5rbajj53wq77fwB12y
|
||||
phMjwz2AnD1BvHZd3vLOaH1jRQP3zzNmyjT/Oj6+jdux7SBKlJWgQEaKflwcvYyc
|
||||
DPFPhGM4KPwEGX61PCrS+l8Lw0Kdy6K4lE+GrfgJrXM5m1Ey1R0c9McYQQPAtYcm
|
||||
cOnHHgkJdEAFVDa76T9C+lcMP6DNckbJIyc/ENrmM2v4rq/JnsJKEEx0VLyLizQx
|
||||
cGU3gp4ckg0ImQ9hV3H/DLWEqfrPuD++zaV81gpstnc9+pLg0Jibvwg3qvIr7nS5
|
||||
acc//qqxH0iJGYoStHW5J5HoM9HcBvhACq5rjzjrNLPYSJqbPJwBHKcql/uUjQ6S
|
||||
SVWe3/CeJp6/vGuY1aRXAk9c/8oO0ZDrLKE8LsUgZesTLnWGd1LQcyQf6UMG1nb9
|
||||
5C3eZRkCVpKma6Hl/SUQNukerlbLOU9InFGNPdeEVq1Jo62XeEi8KMbTPdXou6Yl
|
||||
rpe99dFnOUjVOdY7gfBGSgIVJjORqf/V70jwsxcYz7j6PKl0XulJs06vpSECAwEA
|
||||
AaOCAmowggJmMBIGA1UdEwEB/wQIMAYBAf8CAQIwHQYDVR0OBBYEFMgAD/zGUvyf
|
||||
2ztkLjK5bi5x82V5MIHhBgNVHSMEgdkwgdaAFLkJypwe29NsOmuu7VTxW5MGNS5e
|
||||
oYGypIGvMIGsMQswCQYDVQQGEwJFVTFDMEEGA1UEBxM6TWFkcmlkIChzZWUgY3Vy
|
||||
cmVudCBhZGRyZXNzIGF0IHd3dy5jYW1lcmZpcm1hLmNvbS9hZGRyZXNzKTESMBAG
|
||||
A1UEBRMJQTgyNzQzMjg3MRswGQYDVQQKExJBQyBDYW1lcmZpcm1hIFMuQS4xJzAl
|
||||
BgNVBAMTHkdsb2JhbCBDaGFtYmVyc2lnbiBSb290IC0gMjAwOIIJAMnN0+nVfSPO
|
||||
MH0GCCsGAQUFBwEBBHEwbzBFBggrBgEFBQcwAoY5aHR0cDovL3d3dy5jYW1lcmZp
|
||||
cm1hLmNvbS9jZXJ0cy9yb290X2NoYW1iZXJzaWduLTIwMDguY3J0MCYGCCsGAQUF
|
||||
BzABhhpodHRwOi8vb2NzcC5jYW1lcmZpcm1hLmNvbTAOBgNVHQ8BAf8EBAMCAQYw
|
||||
PgYDVR0gBDcwNTAzBgRVHSAAMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vcG9saWN5
|
||||
LmNhbWVyZmlybWEuY29tMH4GA1UdHwR3MHUwOKA2oDSGMmh0dHA6Ly9jcmwuY2Ft
|
||||
ZXJmaXJtYS5jb20vY2hhbWJlcnNpZ25yb290LTIwMDguY3JsMDmgN6A1hjNodHRw
|
||||
Oi8vY3JsMS5jYW1lcmZpcm1hLmNvbS9jaGFtYmVyc2lnbnJvb3QtMjAwOC5jcmww
|
||||
DQYJKoZIhvcNAQEFBQADggIBABNYG4jBwoI7e8pCuUyDc6rwpE9H6AgrUdL7O1xK
|
||||
TgTjDGBrMOBK+ZPS4Si8J3yZngvSrL694a1HmiiblJ+CmCdNGli2nBBM+OPK3tQB
|
||||
4TW6hgkIe3vSNg/9o9y6+MAJcm8Kn0nPCBkSRME87NwvpehtekuF1G2ng1KDVwAn
|
||||
F+eCXfNanEwY++vWbJAuPE69Z/0+rCgNyH1PzihiNu6vrUlSlLWKaG34O1DEttX+
|
||||
SsWTpEbpH9w5y9Vmw6WQ/B5nfhPM551HaMbiGgSxT9jHmf8APYQ3iT8EktcdTAdw
|
||||
m1miiyxfKG+WjPT7P/x8Np1spJZw+sNIDTLdZ0T1XQ6obVkBTFUDSULKW8949HDu
|
||||
VSwdl9Hu9lkDzzh9tyVYwwjEWVFZOiD/4TPVLfphf4ZEiyHt5YpNd9kZJIGGDxdc
|
||||
CdtzPm2dQODFpv72LnPQHbuBQPJ71zkoAmyeM/1Qj0DlrFsPcYnbRasck1VmYgDc
|
||||
Xc0+is0wcgCd7Gpx1zpEeVqwMD96am2xZPzd6nsbXvo+6TzsKLRMJo6nOERwrzuI
|
||||
F+/eq3WXxYMt2UenJsHqwSgPJRMdl3SFz0+SZN0viHeLuwb7qaHN74qC6GP8yHGp
|
||||
2xe6Z11mJDPLDSrQQ2dOceSJ1LurJgLP7amYmFlWwVnmM7LnfShhMWMV+MDrICnL
|
||||
2ksL
|
||||
-----END CERTIFICATE-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue