Trust store release 2025.1.0 (#306)

Rolling trust store release at 2025-01-05T03:23:10+0000.
$ cfssl-trust -d ./cert.db  -b int release 504h
skipping expired certificate (SKI=5aacc2e19f8e44149c09aaa7f6bb94f7e087df45, serial=15406540176900952074216105222480925475, subject='/RU-CENTER High Assurance Services CA 2/C=RU/O=RU-Center (ЗАО Региональный Сетевой Информационный Центр)/L=Moscow/ST=Moscow')
skipping expired certificate (SKI=836b0f870f3fff90351f8d133e6fd3a5eba60cfc, serial=13468007623559662253677767998506786099, subject='/www.lh.pl/C=PL/O=LH.pl Sp. z o.o./OU=LH.pl')
1385 certificates rolled
2 certificates skipped
Successfully rolled new int release 2025.1.0
$ cfssl-trust -d ./cert.db  -b ca release 504h
skipping expired certificate (SKI=15298cc54569abb8b3c3eafe4bb831d8dcf0e776, serial=100, subject='/PostSignum Root QCA 2/C=CZ/O=Česká pošta, s.p. [IČ 47114983]')
350 certificates rolled
1 certificates skipped
Successfully rolled new ca release 2025.1.0
$ cfssl-trust -d ./cert.db  -r 2025.1.0 -b int bundle int-bundle.crt
selected release 2025.1.0
Selected 1385 certificates for this release.
$ cfssl-trust -d ./cert.db  -r 2025.1.0 -b ca bundle ca-bundle.crt
selected release 2025.1.0
Selected 350 certificates for this release.
$ certdump ca-bundle.crt  > certdata/ca-bundle.txt
$ certdump int-bundle.crt > certdata/int-bundle.txt
$ git status --porcelain -uno
M  ca-bundle.crt
M  cert.db
M  certdata/ca-bundle.txt
M  certdata/int-bundle.txt
M  int-bundle.crt

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

ca-bundle.crt

@@ -3995,38 +3995,6 @@ QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
 NVOFBkpdn627G190
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIFnDCCBISgAwIBAgIBZDANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJDWjEs
-MCoGA1UECgwjxIxlc2vDoSBwb8WhdGEsIHMucC4gW0nEjCA0NzExNDk4M10xHjAc
-BgNVBAMTFVBvc3RTaWdudW0gUm9vdCBRQ0EgMjAeFw0xMDAxMTkwODA0MzFaFw0y
-NTAxMTkwODA0MzFaMFsxCzAJBgNVBAYTAkNaMSwwKgYDVQQKDCPEjGVza8OhIHBv
-xaF0YSwgcy5wLiBbScSMIDQ3MTE0OTgzXTEeMBwGA1UEAxMVUG9zdFNpZ251bSBS
-b290IFFDQSAyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoFz8yBxf
-2gf1uN0GGXknvGHwurpp4Lw3ZPWZB6nEBDGjSGIXK0Or6Xa3ZT+tVDTeUUjT133G
-7Vs51D6z/ShWy+9T7a1f6XInakewyFj8PT0EdZ4tAybNYdEUO/dShg2WvUyfZfXH
-0jmmZm6qUDy0VfKQfiyWchQRi/Ax6zXaU2+X3hXBfvRMr5l6zgxYVATEyxCfOLM9
-a5U6lhpyCDf2Gg6dPc5Cy6QwYGGpYER1fzLGsN9stdutkwlP13DHU1Sp6W5ywtfL
-owYaV1bqOOdARbAoJ7q8LO6EBjyIVr03mFusPaMCOzcEn3zL5XafknM36Vqtdmqz
-iWR+3URAUgqE0wIDAQABo4ICaTCCAmUwgaUGA1UdHwSBnTCBmjAxoC+gLYYraHR0
-cDovL3d3dy5wb3N0c2lnbnVtLmN6L2NybC9wc3Jvb3RxY2EyLmNybDAyoDCgLoYs
-aHR0cDovL3d3dzIucG9zdHNpZ251bS5jei9jcmwvcHNyb290cWNhMi5jcmwwMaAv
-oC2GK2h0dHA6Ly9wb3N0c2lnbnVtLnR0Yy5jei9jcmwvcHNyb290cWNhMi5jcmww
-gfEGA1UdIASB6TCB5jCB4wYEVR0gADCB2jCB1wYIKwYBBQUHAgIwgcoagcdUZW50
-byBrdmFsaWZpa292YW55IHN5c3RlbW92eSBjZXJ0aWZpa2F0IGJ5bCB2eWRhbiBw
-b2RsZSB6YWtvbmEgMjI3LzIwMDBTYi4gYSBuYXZhem55Y2ggcHJlZHBpc3UvVGhp
-cyBxdWFsaWZpZWQgc3lzdGVtIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNjb3Jk
-aW5nIHRvIExhdyBObyAyMjcvMjAwMENvbGwuIGFuZCByZWxhdGVkIHJlZ3VsYXRp
-b25zMBIGA1UdEwEB/wQIMAYBAf8CAQEwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQW
-BBQVKYzFRWmruLPD6v5LuDHY3PDndjCBgwYDVR0jBHwweoAUFSmMxUVpq7izw+r+
-S7gx2Nzw53ahX6RdMFsxCzAJBgNVBAYTAkNaMSwwKgYDVQQKDCPEjGVza8OhIHBv
-xaF0YSwgcy5wLiBbScSMIDQ3MTE0OTgzXTEeMBwGA1UEAxMVUG9zdFNpZ251bSBS
-b290IFFDQSAyggFkMA0GCSqGSIb3DQEBCwUAA4IBAQBeKtoLQKFqWJEgLNxPbQNN
-5OTjbpOTEEkq2jFI0tUhtRx//6zwuqJCzfO/KqggUrHBca+GV/qXcNzNAlytyM71
-fMv/VwgL9gBHTN/IFIw100JbciI23yFQTdF/UoEfK/m+IFfirxSRi8LRERdXHTEb
-vwxMXIzZVXloWvX64UwWtf4Tvw5bAoPj0O1Z2ly4aMTAT2a+y+z184UhuZ/oGyMw
-eIakmFM7M7RrNki507jiSLTzuaFMCpyWOX7ULIhzY6xKdm5iQLjTvExn2JTvVChF
-Y+jUu/G0zAdLyeU4vaXdQm1A8AEiJPTd0Z9LAxL6Sq2iraLNN36+NyEK/ts3mPLL
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
 MIIDTDCCAjSgAwIBAgIId3cGJyapsXwwDQYJKoZIhvcNAQELBQAwRDELMAkGA1UE
 BhMCVVMxFDASBgNVBAoMC0FmZmlybVRydXN0MR8wHQYDVQQDDBZBZmZpcm1UcnVz
 dCBDb21tZXJjaWFsMB4XDTEwMDEyOTE0MDYwNloXDTMwMTIzMTE0MDYwNlowRDEL

cert.db

@@ -2142,20 +2142,6 @@ Details:
 	Basic constraints: valid, is a CA certificate
 	SANs (0):
 CERTIFICATE
-Subject: /PostSignum Root QCA 2/C=CZ/O=Česká pošta, s.p. [IČ 47114983]
-Issuer: /PostSignum Root QCA 2/C=CZ/O=Česká pošta, s.p. [IČ 47114983]
-	Signature algorithm: RSA / SHA256
-Details:
-	Public key: RSA-2048
-	Serial number: 100
-	AKI: 15:29:8C:C5:45:69:AB:B8:B3:C3:EA:FE:4B:B8:31:D8:DC:F0:E7:76
-	SKI: 15:29:8C:C5:45:69:AB:B8:B3:C3:EA:FE:4B:B8:31:D8:DC:F0:E7:76
-	Valid from: 2010-01-19T08:04:31+0000
-	     until: 2025-01-19T08:04:31+0000
-	Key usages: cert sign, crl sign
-	Basic constraints: valid, is a CA certificate, max path length 1
-	SANs (0):
-CERTIFICATE
 Subject: /AffirmTrust Commercial/C=US/O=AffirmTrust
 Issuer: /AffirmTrust Commercial/C=US/O=AffirmTrust
 	Signature algorithm: RSA / SHA256

certdata/ca-bundle.txt

@@ -3593,28 +3593,6 @@ Details:
 	OCSP server:
 		- http://ocsp.accv.es
 CERTIFICATE
-Subject: /RU-CENTER High Assurance Services CA 2/C=RU/O=RU-Center (ЗАО
-    Региональный Сетевой Информационный
-    Центр)/L=Moscow/ST=Moscow
-Issuer: /USERTrust RSA Certification Authority/C=US/O=The USERTRUST
-    Network/L=Jersey City/ST=New Jersey
-	Signature algorithm: RSA / SHA384
-Details:
-	Public key: RSA-2048
-	Serial number: 15406540176900952074216105222480925475
-	AKI: 53:79:BF:5A:AA:2B:4A:CF:54:80:E1:D8:9B:C0:9D:F2:B2:03:66:CB
-	SKI: 5A:AC:C2:E1:9F:8E:44:14:9C:09:AA:A7:F6:BB:94:F7:E0:87:DF:45
-	Valid from: 2015-01-21T00:00:00+0000
-	     until: 2025-01-20T23:59:59+0000
-	Key usages: cert sign, crl sign, digital signature
-	Extended usages: client auth, server auth
-	Basic constraints: valid, is a CA certificate, max path length 0
-	SANs (0):
-	1 AIA:
-		http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
-	OCSP server:
-		- http://ocsp.usertrust.com
-CERTIFICATE
 Subject: /ACCVCA-120/C=ES/O=ACCV/OU=PKIACCV
 Issuer: /ACCVRAIZ1/C=ES/O=ACCV/OU=PKIACCV
 	Signature algorithm: RSA / SHA256
@@ -3631,25 +3609,6 @@ Details:
 	OCSP server:
 		- http://ocsp.accv.es
 CERTIFICATE
-Subject: /www.lh.pl/C=PL/O=LH.pl Sp. z o.o./OU=LH.pl
-Issuer: /Certum Global Services CA SHA2/C=PL/O=Unizeto Technologies
-    S.A./OU=Certum Certification Authority
-	Signature algorithm: RSA / SHA256
-Details:
-	Public key: RSA-2048
-	Serial number: 13468007623559662253677767998506786099
-	AKI: 54:99:DD:9B:FF:E8:A7:0E:A3:19:9D:5B:BE:42:57:DF:30:FC:8F:32
-	SKI: 83:6B:0F:87:0F:3F:FF:90:35:1F:8D:13:3E:6F:D3:A5:EB:A6:0C:FC
-	Valid from: 2015-01-28T08:58:34+0000
-	     until: 2025-01-25T08:58:34+0000
-	Key usages: cert sign, crl sign
-	Basic constraints: valid, is a CA certificate, max path length 0
-	SANs (0):
-	1 AIA:
-		http://repository.certum.pl/gscasha2.cer
-	OCSP server:
-		- http://subca.ocsp-certum.com
-CERTIFICATE
 Subject: /Jax HR Saint Vincents HIE CA/C=US/O=Jax Health Records - SV
     HIE/OU=Orion Health Direct Secure Messaging
 Issuer: /Orion Health Direct Secure Messaging CA/C=US/O=Orion Health

certdata/int-bundle.txt

@@ -6688,42 +6688,6 @@ VFGkJup4TJel2gw1sYi4z7FadKTi9c9JZSuYN4Zb+qtM8ysaB1bg7UfU+dAry8nF
 xuHeo4MhiF6cx7HxobOy2p7riigccw==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIGWDCCBECgAwIBAgIQC5cxE68zwsnRDfWE1f0TIzANBgkqhkiG9w0BAQwFADCB
-iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
-cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
-BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUw
-MTIxMDAwMDAwWhcNMjUwMTIwMjM1OTU5WjCBzTELMAkGA1UEBhMCUlUxDzANBgNV
-BAgTBk1vc2NvdzEPMA0GA1UEBxMGTW9zY293MWswaQYDVQQKDGJSVS1DZW50ZXIg
-KNCX0JDQniDQoNC10LPQuNC+0L3QsNC70YzQvdGL0Lkg0KHQtdGC0LXQstC+0Lkg
-0JjQvdGE0L7RgNC80LDRhtC40L7QvdC90YvQuSDQptC10L3RgtGAKTEvMC0GA1UE
-AxMmUlUtQ0VOVEVSIEhpZ2ggQXNzdXJhbmNlIFNlcnZpY2VzIENBIDIwggEiMA0G
-CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDFqrrqMXLFg3JXv+96joUUqXsWiwB
-H/T30BrHtpOvmiNS3OT5fdV65lCf3KvVLgJn/JXdlb2zsBZJ5pmMSIj6fCqKFZQi
-L+XJm6gACK/WWm/Y0qhmzlCbms6/xMnaH7dWy08uDBpy4tdqd/YEyZftz3HBO+PD
-eEMf4XwNKRuTXev9PqRV2WIL/+PzYwL5HPp2mzfDmFntCKj4AxJ0pU5qETiKyu/c
-bI+s+3jpm9yKTi9AAVmHcDpzkmi5zcJv00oRtQHoFEL5fg92LvCMn32KjUNLBmPP
-Zv46Ldop21KJx4QVIraeXAIAEBjScGnVboNN/3sJQ96NaGPfXOaDTbdfAgMBAAGj
-ggF1MIIBcTAfBgNVHSMEGDAWgBRTeb9aqitKz1SA4dibwJ3ysgNmyzAdBgNVHQ4E
-FgQUWqzC4Z+ORBScCaqn9ruU9+CH30UwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB
-/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1Ud
-IAQbMBkwDQYLKwYBBAGyMQECAhAwCAYGZ4EMAQICMFAGA1UdHwRJMEcwRaBDoEGG
-P2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0
-aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0
-dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNy
-dDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG
-9w0BAQwFAAOCAgEAT4oyUpecGhb4F9lSyeCkhMEuiBcvjhT1rt+4ZW/mBL+Dzlix
-oGKBBXFhggiPSgc99iR6D+91kuTgePkwy0RFkJR0JXDsQBbdea+GhlBEBngtQgDr
-KsVd7Bk2FKO8Mx9oyqqdFCImajTkmtKdLr/5kopiO4Jc0ELNhIkBstKZspqEQhG2
-XAdnI2yY6SudQyUX+CdbNwAWc8bBvaK7gyNTSTv/PXm0qvJTWU46vHemgIBmnn8l
-8G6dnTsY2gdPUOu/R6a7QExch8dfJvjremFf+QcuKBiutrsIKc2T6r89nQ6+bXq2
-FjauvCuRKj3MXCTHvMM28f35Xj927dbXZv3izLuKV3cimJkTbnOlKvBRT7X6FGzd
-Iq58QI2SV/LLB3H/BoQWhGHgvQpXrTFDAV404cyFqYhEb+017hla/DjLGaqo3VsZ
-FPzJCwoI80LmmDIrYh4yYREaKTMJrLNSqgmZ1N56df+mNZnXWt11rUTfQ1jpy9lG
-9Z6LE6xIlD8nrMpY6tdmOw7TXhy/SJLBADCbdgNPjW4xVT+89lhXtIH1dRHfJyzW
-M1sCcZrbFuoTxwy1tn1EpM9l7YjMCVQAP6NE79vC+nLURZbbIYSbosmdvAd/+PUz
-p2wmoFf+gA5JQwKaRcbkEMlsxXaxqwLOyv7YhHbEAW0DscFfuFTsb02wGps=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
 MIIHkjCCBXqgAwIBAgIIQfac0r2AwLcwDQYJKoZIhvcNAQELBQAwQjESMBAGA1UE
 AwwJQUNDVlJBSVoxMRAwDgYDVQQLDAdQS0lBQ0NWMQ0wCwYDVQQKDARBQ0NWMQsw
 CQYDVQQGEwJFUzAeFw0xNTAxMjcxNDA2NDJaFw0yNjEyMzEyMzU5MDBaMEMxEzAR
@@ -6767,32 +6731,6 @@ lktHpcv7aDcwWWup9ZF7SAbgmy0dig0n8+AofQQnYbi0jgcdjguxsvYznwgf+SsI
 IF+BTEMSGWi5MDbppe3b+TbqsRDXGA==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIEaDCCA1CgAwIBAgIQCiHYCveU7ZBGgWo8XbPdMzANBgkqhkiG9w0BAQsFADCB
-gzELMAkGA1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMu
-QS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEnMCUG
-A1UEAxMeQ2VydHVtIEdsb2JhbCBTZXJ2aWNlcyBDQSBTSEEyMB4XDTE1MDEyODA4
-NTgzNFoXDTI1MDEyNTA4NTgzNFowTDELMAkGA1UEBhMCUEwxGTAXBgNVBAoMEExI
-LnBsIFNwLiB6IG8uby4xDjAMBgNVBAsMBUxILnBsMRIwEAYDVQQDDAl3d3cubGgu
-cGwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3er+96TfX9m1yJL7y
-CGFQ4wyhA8oQDdjYDtjjB+2/9WTKYpw+xPnzOx+VWWx7pbQQ2pEh5rBnvKVi+zlE
-71Z22xDpVgXuTLB38+MEXOEKALw7d04ssxp1QGWl07WdIubr5+xukVQ//1FIRjPt
-Hl6IGp0WDQNg8AhHGRxADEESHiVqze4mzL0Cu1hjEgMV7M7aKlyjcb+EWgWQJpNn
-yYlO+9MFU5N1vQflsF5Cw6CgzjQJDSQutGAEyzg4aVAWPS+0/i3scdszIuOtNvTH
-ZXCGPiPOoIK2IfhUTrAgV5pdRmro1SNSSrkS69K7iXKyLpap+ObjrScJS23xjbQ9
-E5l1AgMBAAGjggEMMIIBCDASBgNVHRMBAf8ECDAGAQH/AgEAMDIGA1UdHwQrMCkw
-J6AloCOGIWh0dHA6Ly9jcmwuY2VydHVtLnBsL2dzY2FzaGEyLmNybDBuBggrBgEF
-BQcBAQRiMGAwKAYIKwYBBQUHMAGGHGh0dHA6Ly9zdWJjYS5vY3NwLWNlcnR1bS5j
-b20wNAYIKwYBBQUHMAKGKGh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9nc2Nh
-c2hhMi5jZXIwHwYDVR0jBBgwFoAUVJndm//opw6jGZ1bvkJX3zD8jzIwHQYDVR0O
-BBYEFINrD4cPP/+QNR+NEz5v06Xrpgz8MA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG
-9w0BAQsFAAOCAQEAIjc/Ufb0wvdl4T/zUJElwzI1TgqtSP976tLDkV5Al9V6NbWY
-NKayQEdnRns41a7gfZa42E32M80dvxdK6z3t9Jd6ZIFVa3nTLI0a8k0ntgoMuMJL
-SMTX4Te5gPF8ekBZ/gaAuafBzlnDapuhjV7SLr5bcE8esLymhujXU8B6Z8LJ5B5M
-oz4SkKQT1zdP9GcudJSvCVM+5MP8BuPYC/oim6reBDpvQtYeAYjR/aDzXxQobYAC
-AgG1gO50uw/eSqE+df1WE6FHKu8QWvh+R9W5XmQEEoO51Tw2vwngue66Wa1UwRAB
-Uy1MiYd4P1htGbW9NpA3QXEmDEpUb55raasZYg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
 MIIGdzCCBV+gAwIBAgIQDAOugIb7rN3dNa34GPCXnDANBgkqhkiG9w0BAQsFADCB
 ijELMAkGA1UEBhMCVVMxGjAYBgNVBAoTEU9yaW9uIEhlYWx0aCBJbmMuMS0wKwYD
 VQQLEyRPcmlvbiBIZWFsdGggRGlyZWN0IFNlY3VyZSBNZXNzYWdpbmcxMDAuBgNV