Update certificate-roots pkg

Toit

#Update certificate-roots pkg

Thread channel in help

Rikke 08/18/2026 07:03 AM

Hello, I am requesting an update to certificate-roots pkg. I am specifically interested in ISRG Root YR because our current certificate is running out in 2030. No rush

OPRikke

Hello, I am requesting an update to certificate-roots pkg. I am specifically interested in ISRG Root YR because our current certificate is running out in 2030. No rush

floitsch 08/18/2026 02:12 PM

Toit's certificate roots are extracted from Mozilla.
Mozilla hasn't added this root yet. That's a long process which can take up to two years (but is usually faster).
Root YR is cross-signed by ISRG Root X1, but Toit only accepts this if the server also sends the complete cross-signed chain (leaf -> YR1 -> Root YR signed by ISRG Root X1). If you have any say in how the certificates are sent, that's the cleanest solution (for now).

floitsch

Toit's certificate roots are extracted from Mozilla. Mozilla hasn't added this root yet. That's a long process which can take up to two years (but is usually faster). Root YR is cr...

Rikke 08/18/2026 02:27 PM

It works for now, the chain does include the complete chain leaf + YR1 + Root YR. The root is very new so I do not expect it to be added to Mozilla this year. If the roots are extended from Mozilla then I am sure it will be added in time. Thanks

3 messages in total