René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"crypto: mk-ca-bundle.pl drops Izenpe.com and loses NSS SERVER_DISTRUST_AFTER semantics","articleBody":"### Version\n\nlatest main branch\n\n### Platform\n\n```text\n\n```\n\n### Subsystem\n\ncrypto\n\n### What steps will reproduce the bug?\n\n```js\n  const { X509Certificate } = require('node:crypto');\n  const tls = require('node:tls');\n\n  const izenpeFingerprint =\n    '25:30:CC:8E:98:32:15:02:BA:D9:6F:9B:1F:BA:1B:09:' +\n    '9E:2D:29:9E:0F:45:48:BB:91:4F:36:3B:C0:D4:53:1F';\n\n  const found = tls.rootCertificates.some((pem) => {\n    return new X509Certificate(pem).fingerprint256 === izenpeFingerprint;\n  });\n\n  console.log(tls.rootCertificates.length); // 120\n  console.log(found); // false\n```\n\n### How often does it reproduce? Is there a required condition?\n\nEvery\n\n### What is the expected behavior? Why is that the expected behavior?\n\nIzenpe.com should remain in the bundled CA store.\n\n  Its NSS policy specifies:\n\n  CKA_NSS_SERVER_DISTRUST_AFTER = 260415235959Z\n\n  Therefore, assuming all other certificate validation succeeds:\n\n  - A server certificate with NotBefore \u003c= 2026-04-15 23:59:59Z should remain trusted.\n  - A server certificate with NotBefore > 2026-04-15 23:59:59Z should be rejected.\n\nThe cutoff applies to the end-entity certificate’s issuance time. It does not mean that the entire root must be removed after that date.\n\nRetained roots with a server distrust-after constraint continue to trust post-cutoff certificates because the metadata is discarded during PEM generation.\n\n### What do you see instead?\n\nThe generated src/node_root_certs.h contains 120 valid PEM certificates, but Izenpe.com is missing.\n\nAs a result, TLS server chains anchored to Izenpe fail when Node uses its bundled CA store, including chains whose end-entity certificate was issued before the NSS distrust after cutoff.\n\nThe missing root can be detected with:\n\nAll existing PEM entries still parse successfully, so a test that only validates PEM syntax does not detect the missing trust anchor.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/Archkon","@type":"Person","name":"Archkon"},"datePublished":"2026-07-26T05:50:37Z","url":"https://github.com/nodejs/node/issues/64752"}