[jdk8u-dev] Integrated: 8361212: Remove AffirmTrust root CAs

[Severin Gehwolf]

On Wed, 27 Aug 2025 12:55:57 GMT, Severin Gehwolf <sgehwolf at openjdk.org> wrote:

> Backport of JDK-8361212 to remove expired certificates. The patch is almost clean as compared to the JDK 11 version (modulo path suffeling).
> 
> Testing:
> 
> Passed: sun/security/lib/cacerts/VerifyCACerts.java
> FAILED: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#actalisauthenticationrootca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca1
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca2
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca3
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#amazonrootca4
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#buypassclass2ca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#buypassclass3ca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#certainlyroote1
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#certainlyrootr1
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#certignarootca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#comodoeccca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#comodorsaca
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlseccrootg5
> FAILED: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#digicerttlsrsarootg5
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#emsigneccrootcag3
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#emsignrootcag1
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#entrustrootcaec1
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#entrustrootcag4
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsigne46
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsigneccrootcar4
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#globalsignr46
> Passed: security/infra/java/security/cert/CertPathValidator/certification/CAIntero...

This pull request has now been integrated.

Changeset: 3f2b6ffe
Author:    Severin Gehwolf <sgehwolf at openjdk.org>
URL:       https://git.openjdk.org/jdk8u-dev/commit/3f2b6ffee4b2a077f5fc8e00d58bce906a80cca0
Stats:     503 lines in 12 files changed: 0 ins; 491 del; 12 mod

8361212: Remove AffirmTrust root CAs

Reviewed-by: andrew
Backport-of: 5173435bfd0db5db0113a6209f2f827b16598596

-------------

PR: https://git.openjdk.org/jdk8u-dev/pull/684