Skip to content

Commit 1fb4c76

Browse files
nicktrnTrigger.dev RepoOps
nicktrn
authored and
Trigger.dev RepoOps
committed
fix(cli): reject compromised emSign intermediates in deploy images
Mono-RevId: 1a718d4e3a17ccfa64fdf90fe1e6849f56bcd1b1
1 parent dac3b03 commit 1fb4c76

4 files changed

Lines changed: 322 additions & 2 deletions

File tree

‎.changeset/distrust-emsign-roots.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
"trigger.dev": patch
33
---
44

5-
Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node tasks now validate TLS against the pruned system store. Bun tasks keep Bun's bundled roots until Bun ships a fix.
5+
Deploy images no longer trust the emSign roots removed after the October 2026 eMudhra CA key compromise, or the Sectigo AAA root that cross-signs the compromised intermediates. Node and Bun tasks now refuse TLS connections through the compromised eMudhra intermediates, including their Sectigo AAA cross-signed copies.

‎packages/cli-v3/src/deploy/buildImage.test.ts‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ import {
88
BUILD_IMAGE,
99
DEFAULT_PACKAGES,
1010
EMSIGN_COMPROMISE_DISTRUSTED_ROOTS,
11+
EMSIGN_REJECT_DIR,
1112
TOOLCHAIN_PACKAGES,
1213
formatCommandForDiagnostics,
1314
generateContainerfile,
1415
} from "./buildImage.js";
16+
import { EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES } from "./emsignRejectedIntermediates.js";
1517

1618
describe("formatCommandForDiagnostics", () => {
1719
it("redacts build argument values without changing the executable arguments", () => {
@@ -156,6 +158,73 @@ describe("generateContainerfile", () => {
156158
);
157159
});
158160

161+
const rejectSteps = (containerfile: string) =>
162+
Array.from(
163+
containerfile.matchAll(
164+
/^RUN mkdir -p \/usr\/local\/share\/ca-certificates\/emsign-block && \\$/gm
165+
)
166+
);
167+
168+
const pemFromStep = (containerfile: string, file: string) => {
169+
const block = containerfile.match(
170+
new RegExp(
171+
`printf '%s\\\\n' \\\\\\n((?: {4}'[^']*' \\\\\\n)+) {4}> ${EMSIGN_REJECT_DIR}/${file}`
172+
)
173+
);
174+
return block ? block[1]!.match(/'([^']*)'/g)!.map((q) => q.slice(1, -1)) : [];
175+
};
176+
177+
it.each(["node", "bun"] as BuildRuntime[])(
178+
"writes the emSign reject entries before refreshing the store in the base and prebuilt build stages on %s",
179+
async (runtime) => {
180+
const containerfile = await generateContainerfile({
181+
runtime,
182+
build: {},
183+
image: undefined,
184+
indexScript: "index.js",
185+
entrypoint: "entrypoint.js",
186+
});
187+
188+
const rejects = rejectSteps(containerfile);
189+
const refreshes = Array.from(
190+
containerfile.matchAll(/^ {2}update-ca-certificates --fresh$/gm)
191+
);
192+
expect(rejects).toHaveLength(2);
193+
expect(refreshes).toHaveLength(2);
194+
expect(rejects[0]!.index).toBeLessThan(refreshes[0]!.index!);
195+
expect(rejects[1]!.index).toBeGreaterThan(refreshes[0]!.index!);
196+
expect(rejects[1]!.index).toBeLessThan(refreshes[1]!.index!);
197+
198+
for (const { file, pemLines } of EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES) {
199+
expect(pemFromStep(containerfile, file)).toEqual(pemLines);
200+
}
201+
}
202+
);
203+
204+
it("writes the reject entries once when the build stage derives from base", async () => {
205+
const containerfile = await generateContainerfile({
206+
runtime: "bun",
207+
build: {},
208+
image: { instructions: ["RUN echo hi"] },
209+
indexScript: "index.js",
210+
entrypoint: "entrypoint.js",
211+
});
212+
213+
expect(rejectSteps(containerfile)).toHaveLength(1);
214+
});
215+
216+
it("ships reject entries that are safe to embed in a shell command", () => {
217+
expect(EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES).toHaveLength(8);
218+
for (const { file, pemLines } of EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES) {
219+
expect(file).toMatch(/^emsign-block-EM-(DV|OV|EV)-(TLS|CS)-CA-G3[BC]-by-[A-Za-z0-9-]+\.crt$/);
220+
expect(pemLines[0]).toBe("-----BEGIN TRUSTED CERTIFICATE-----");
221+
expect(pemLines.at(-1)).toBe("-----END TRUSTED CERTIFICATE-----");
222+
for (const line of pemLines.slice(1, -1)) {
223+
expect(line).toMatch(/^[A-Za-z0-9+/=]+$/);
224+
}
225+
}
226+
});
227+
159228
it("pairs every runtime image with its -build variant", () => {
160229
for (const runtime of Object.keys(BASE_IMAGE) as BuildRuntime[]) {
161230
const baseRef = BASE_IMAGE[runtime].split("@")[0];

‎packages/cli-v3/src/deploy/buildImage.ts‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import { z } from "zod";
1212
import { assertExhaustive } from "../utilities/assertExhaustive.js";
1313
import { tryCatch } from "@trigger.dev/core";
1414
import type { CliApiClient } from "../apiClient.js";
15+
import { EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES } from "./emsignRejectedIntermediates.js";
1516

1617
export interface BuildImageOptions {
1718
// Common options
@@ -740,7 +741,18 @@ export const EMSIGN_COMPROMISE_DISTRUSTED_ROOTS = [
740741
"Comodo_AAA_Services_root",
741742
];
742743

743-
const distrustCompromisedRoots = `RUN sed -i -E 's#^(mozilla/(${EMSIGN_COMPROMISE_DISTRUSTED_ROOTS.join(
744+
export const EMSIGN_REJECT_DIR = "/usr/local/share/ca-certificates/emsign-block";
745+
746+
const rejectCompromisedIntermediates = `RUN mkdir -p ${EMSIGN_REJECT_DIR} && \\
747+
${EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES.map(
748+
({ file, pemLines }) =>
749+
` printf '%s\\n' \\\n${pemLines
750+
.map((line) => ` '${line}' \\`)
751+
.join("\n")}\n > ${EMSIGN_REJECT_DIR}/${file}`
752+
).join(" && \\\n")}`;
753+
754+
const distrustCompromisedRoots = `${rejectCompromisedIntermediates}
755+
RUN sed -i -E 's#^(mozilla/(${EMSIGN_COMPROMISE_DISTRUSTED_ROOTS.join(
744756
"|"
745757
)})\\.crt)$#!\\1#' /etc/ca-certificates.conf && \\
746758
update-ca-certificates --fresh

‎packages/cli-v3/src/deploy/emsignRejectedIntermediates.ts‎

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
export type RejectedIntermediate = {
2+
file: string;
3+
pemLines: ReadonlyArray<string>;
4+
};
5+
6+
export const EMSIGN_COMPROMISE_REJECTED_INTERMEDIATES: ReadonlyArray<RejectedIntermediate> = [
7+
{
8+
file: "emsign-block-EM-DV-TLS-CA-G3B-by-emSign-Root-TLS-CA-G3.crt",
9+
pemLines: [
10+
"-----BEGIN TRUSTED CERTIFICATE-----",
11+
"MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw",
12+
"CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl",
13+
"ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1",
14+
"NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11",
15+
"ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C",
16+
"AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J",
17+
"hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p",
18+
"1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L",
19+
"WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG",
20+
"CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow",
21+
"KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB",
22+
"BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY",
23+
"aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw",
24+
"b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f",
25+
"BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j",
26+
"cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E",
27+
"AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO",
28+
"Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8",
29+
"gt2TlfJbHii+KNvKMIGfoEIGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lAAYIKwYB",
30+
"BQUHAwQGCCsGAQUFBwMDBggrBgEFBQcDCAYIKwYBBQUHAwkMWUJMT0NLRUQga2V5",
31+
"IGNvbXByb21pc2UgMjAyNi0xMC0xNzogRU0gRFYgVExTIENBIC0gRzNCIChpc3N1",
32+
"ZWQgYnkgZW1TaWduIFJvb3QgVExTIENBIC0gRzMp",
33+
"-----END TRUSTED CERTIFICATE-----",
34+
],
35+
},
36+
{
37+
file: "emsign-block-EM-DV-TLS-CA-G3C-by-emSign-Root-TLS-CA-G3.crt",
38+
pemLines: [
39+
"-----BEGIN TRUSTED CERTIFICATE-----",
40+
"MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ",
41+
"BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk",
42+
"MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1",
43+
"MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk",
44+
"aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C",
45+
"AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy",
46+
"pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV",
47+
"bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L",
48+
"WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG",
49+
"CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow",
50+
"KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB",
51+
"BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY",
52+
"aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw",
53+
"b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f",
54+
"BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j",
55+
"cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E",
56+
"AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg",
57+
"yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd",
58+
"AEKwaJ0mVzScy2+6MIGfoEIGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lAAYIKwYB",
59+
"BQUHAwQGCCsGAQUFBwMDBggrBgEFBQcDCAYIKwYBBQUHAwkMWUJMT0NLRUQga2V5",
60+
"IGNvbXByb21pc2UgMjAyNi0xMC0xNzogRU0gRFYgVExTIENBIC0gRzNDIChpc3N1",
61+
"ZWQgYnkgZW1TaWduIFJvb3QgVExTIENBIC0gRzMp",
62+
"-----END TRUSTED CERTIFICATE-----",
63+
],
64+
},
65+
{
66+
file: "emsign-block-EM-EV-TLS-CA-G3B-by-emSign-Root-TLS-CA-G3.crt",
67+
pemLines: [
68+
"-----BEGIN TRUSTED CERTIFICATE-----",
69+
"MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw",
70+
"CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl",
71+
"ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw",
72+
"MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11",
73+
"ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C",
74+
"AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB",
75+
"9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ",
76+
"5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L",
77+
"WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG",
78+
"CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow",
79+
"KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB",
80+
"BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho",
81+
"dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv",
82+
"c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E",
83+
"MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy",
84+
"bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD",
85+
"AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA",
86+
"lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6",
87+
"MN/P+ByGeiRMghzBMIGfoEIGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lAAYIKwYB",
88+
"BQUHAwQGCCsGAQUFBwMDBggrBgEFBQcDCAYIKwYBBQUHAwkMWUJMT0NLRUQga2V5",
89+
"IGNvbXByb21pc2UgMjAyNi0xMC0xNzogRU0gRVYgVExTIENBIC0gRzNCIChpc3N1",
90+
"ZWQgYnkgZW1TaWduIFJvb3QgVExTIENBIC0gRzMp",
91+
"-----END TRUSTED CERTIFICATE-----",
92+
],
93+
},
94+
{
95+
file: "emsign-block-EM-EV-TLS-CA-G3C-by-emSign-Root-TLS-CA-G3.crt",
96+
pemLines: [
97+
"-----BEGIN TRUSTED CERTIFICATE-----",
98+
"MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw",
99+
"CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl",
100+
"ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz",
101+
"OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11",
102+
"ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49",
103+
"AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+",
104+
"bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm",
105+
"xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9",
106+
"i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU",
107+
"BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq",
108+
"MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG",
109+
"AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY",
110+
"aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw",
111+
"b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f",
112+
"BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j",
113+
"cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E",
114+
"AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc",
115+
"9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f",
116+
"Aal1GNxsOutLnr0YMIGfoEIGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lAAYIKwYB",
117+
"BQUHAwQGCCsGAQUFBwMDBggrBgEFBQcDCAYIKwYBBQUHAwkMWUJMT0NLRUQga2V5",
118+
"IGNvbXByb21pc2UgMjAyNi0xMC0xNzogRU0gRVYgVExTIENBIC0gRzNDIChpc3N1",
119+
"ZWQgYnkgZW1TaWduIFJvb3QgVExTIENBIC0gRzMp",
120+
"-----END TRUSTED CERTIFICATE-----",
121+
],
122+
},
123+
{
124+
file: "emsign-block-EM-OV-CS-CA-G3B-by-emSign-Root-CS-CA-G3.crt",
125+
pemLines: [
126+
"-----BEGIN TRUSTED CERTIFICATE-----",
127+
"MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ",
128+
"BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk",
129+
"MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy",
130+
"N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo",
131+
"cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF",
132+
"K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb",
133+
"NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord",
134+
"d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r",
135+
"zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG",
136+
"AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc",
137+
"aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG",
138+
"Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At",
139+
"Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp",
140+
"Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo",
141+
"dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE",
142+
"AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03",
143+
"YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9",
144+
"HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrMw",
145+
"gZ2gQgYIKwYBBQUHAwEGCCsGAQUFBwMCBgRVHSUABggrBgEFBQcDBAYIKwYBBQUH",
146+
"AwMGCCsGAQUFBwMIBggrBgEFBQcDCQxXQkxPQ0tFRCBrZXkgY29tcHJvbWlzZSAy",
147+
"MDI2LTEwLTE3OiBFTSBPViBDUyBDQSAtIEczQiAoaXNzdWVkIGJ5IGVtU2lnbiBS",
148+
"b290IENTIENBIC0gRzMp",
149+
"-----END TRUSTED CERTIFICATE-----",
150+
],
151+
},
152+
{
153+
file: "emsign-block-EM-OV-CS-CA-G3C-by-emSign-Root-CS-CA-G3.crt",
154+
pemLines: [
155+
"-----BEGIN TRUSTED CERTIFICATE-----",
156+
"MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ",
157+
"BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk",
158+
"MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0",
159+
"MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo",
160+
"cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG",
161+
"BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9",
162+
"O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb",
163+
"X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN",
164+
"q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr",
165+
"BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW",
166+
"HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG",
167+
"BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw",
168+
"LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z",
169+
"aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl",
170+
"aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E",
171+
"BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg",
172+
"8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg",
173+
"euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0w",
174+
"gZ2gQgYIKwYBBQUHAwEGCCsGAQUFBwMCBgRVHSUABggrBgEFBQcDBAYIKwYBBQUH",
175+
"AwMGCCsGAQUFBwMIBggrBgEFBQcDCQxXQkxPQ0tFRCBrZXkgY29tcHJvbWlzZSAy",
176+
"MDI2LTEwLTE3OiBFTSBPViBDUyBDQSAtIEczQyAoaXNzdWVkIGJ5IGVtU2lnbiBS",
177+
"b290IENTIENBIC0gRzMp",
178+
"-----END TRUSTED CERTIFICATE-----",
179+
],
180+
},
181+
{
182+
file: "emsign-block-EM-OV-TLS-CA-G3B-by-emSign-Root-TLS-CA-G3.crt",
183+
pemLines: [
184+
"-----BEGIN TRUSTED CERTIFICATE-----",
185+
"MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ",
186+
"BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk",
187+
"MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw",
188+
"MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk",
189+
"aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB",
190+
"BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK",
191+
"56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft",
192+
"DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ",
193+
"QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI",
194+
"KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo",
195+
"BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE",
196+
"AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho",
197+
"dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv",
198+
"c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E",
199+
"MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy",
200+
"bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD",
201+
"AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc",
202+
"28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe",
203+
"8Dz3bQjauvy9uzCBn6BCBggrBgEFBQcDAQYIKwYBBQUHAwIGBFUdJQAGCCsGAQUF",
204+
"BwMEBggrBgEFBQcDAwYIKwYBBQUHAwgGCCsGAQUFBwMJDFlCTE9DS0VEIGtleSBj",
205+
"b21wcm9taXNlIDIwMjYtMTAtMTc6IEVNIE9WIFRMUyBDQSAtIEczQiAoaXNzdWVk",
206+
"IGJ5IGVtU2lnbiBSb290IFRMUyBDQSAtIEczKQ==",
207+
"-----END TRUSTED CERTIFICATE-----",
208+
],
209+
},
210+
{
211+
file: "emsign-block-EM-OV-TLS-CA-G3C-by-emSign-Root-TLS-CA-G3.crt",
212+
pemLines: [
213+
"-----BEGIN TRUSTED CERTIFICATE-----",
214+
"MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ",
215+
"BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk",
216+
"MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3",
217+
"NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk",
218+
"aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C",
219+
"AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ",
220+
"fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+",
221+
"N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L",
222+
"WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG",
223+
"CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow",
224+
"KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB",
225+
"BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY",
226+
"aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw",
227+
"b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f",
228+
"BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j",
229+
"cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E",
230+
"AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c",
231+
"NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79",
232+
"4rSb9vGqxZzelQthMIGfoEIGCCsGAQUFBwMBBggrBgEFBQcDAgYEVR0lAAYIKwYB",
233+
"BQUHAwQGCCsGAQUFBwMDBggrBgEFBQcDCAYIKwYBBQUHAwkMWUJMT0NLRUQga2V5",
234+
"IGNvbXByb21pc2UgMjAyNi0xMC0xNzogRU0gT1YgVExTIENBIC0gRzNDIChpc3N1",
235+
"ZWQgYnkgZW1TaWduIFJvb3QgVExTIENBIC0gRzMp",
236+
"-----END TRUSTED CERTIFICATE-----",
237+
],
238+
},
239+
];

0 commit comments

Comments
 (0)