api: new internal CA

Author: abh

api/tls/ca.pem

@@ -1,4 +1,33 @@
-# ca.ntppool.org root
+# NTP Pool CA Trust Bundle
+# Contains both root CAs for transition period (until 2031)
+#
+# After Aug 2031: Remove the old root (ca.ntppool.org) section
+
+# New Root CA: ca.ntppool.org v2
+# Algorithm: EC P-384
+# Valid: Dec 2025 - Dec 2045 (20 years)
+# Issuer: Self-signed
+-----BEGIN CERTIFICATE-----
+MIICVzCCAd6gAwIBAgIUW1p4RGxD5C8vW7QWWbHkuMHuFWAwCgYIKoZIzj0EAwMw
+HDEaMBgGA1UEAxMRY2EubnRwcG9vbC5vcmcgdjIwHhcNMjUxMjMxMDc1NjE5WhcN
+NDUxMjI2MDc1NjQ5WjAcMRowGAYDVQQDExFjYS5udHBwb29sLm9yZyB2MjB2MBAG
+ByqGSM49AgEGBSuBBAAiA2IABN3v8sHY0pE8m0tUJxUZ6tCqA7QISUjPlSwLcS1S
+d6teNoh5lkFM2DTMYyvpkXmcAyr0iCF/y2rKPtexNOt1hxJqDGAnTWSbicAWTnBM
+BGLrH0racXwP2vb6plxzmvX/a6OB4DCB3TAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUP2krFxfe9LivMYVwM14xtOfWx0EwHwYDVR0j
+BBgwFoAUP2krFxfe9LivMYVwM14xtOfWx0EwQQYIKwYBBQUHAQEENTAzMDEGCCsG
+AQUFBzAChiVodHRwczovL2NhLm50cHBvb2wub3JnL3YxL3BraV9yb290L2NhMDcG
+A1UdHwQwMC4wLKAqoCiGJmh0dHBzOi8vY2EubnRwcG9vbC5vcmcvdjEvcGtpX3Jv
+b3QvY3JsMAoGCCqGSM49BAMDA2cAMGQCMFkdee5GlSjPWMkftad07FaVlKbP92bW
+m5P6JVpRliD3Z7Juyg2jrGPMRDdYUa3+GQIwL0xP4YyGfzok532P/GgpTl/tpZgY
+2ZsHoaLV/hGiufX8wPqD5QgwFk250MH1jSWJ
+-----END CERTIFICATE-----
+
+# Old Root CA: ca.ntppool.org (DEPRECATED - remove after Aug 2031)
+# Algorithm: RSA 2048
+# Valid: Aug 2021 - Aug 2031 (10 years)
+# Issuer: Self-signed
+# Note: Kept for backward compatibility with existing clients
 -----BEGIN CERTIFICATE-----
 MIIDPjCCAiagAwIBAgIUQVMc/U43K+90+J9fuNzHKWaxdM8wDQYJKoZIhvcNAQEL
 BQAwGTEXMBUGA1UEAxMOY2EubnRwcG9vbC5vcmcwHhcNMjEwODE5MDA1MzU2WhcN
@@ -19,27 +48,3 @@ EpgbpNPkonaOwA9MUvF4oWYzy7zICcUR9d1omCsy/9eA3pLNNoUIzkYp2NnWHooS
 sbGknkQhe7ONqV2bIIVkANdDVkzRfRfWCmZdbr0s1rbmJOHRbINW9oY7uB6oPp5g
 MQBzqrVek5I75ZU3lMajUICZ
 -----END CERTIFICATE-----
-
-# ca.ntppool.org -- servers sub CA
------BEGIN CERTIFICATE-----
-MIIDnjCCAoagAwIBAgIUW4mGdSTZaOd89zLzGzH2TMnYFxgwDQYJKoZIhvcNAQEL
-BQAwGTEXMBUGA1UEAxMOY2EubnRwcG9vbC5vcmcwHhcNMjEwODE5MDMwOTIyWhcN
-MjYwODE4MDMwOTUyWjAuMSwwKgYDVQQDEyNjYS5udHBwb29sLm9yZyBzdWItc3lz
-dGVtIGF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKfA
-y/z6C0L9T9i6kif9LPkjwOpAz69a+kDIVuuAC84NJgqLvEDEwRl4l/bpJR1MC509
-x4WUxIrAKinT2y1Olj+oEjTR+asvgXcxhjX5fup9ywDQW75om0ARDCUWg6gN5SX7
-NksZEMcHr7N48GyA76EpmRFU+yGt4rIpCo6EAG+lzhRdB6YS71zSHl1TQ6sZ4oIl
-JYPediXmG+TDvxJWlVOr/eKwgFruL6T/vQ/HTBpo04KTOEt2imnNYZPF2FjHMXP3
-3ql90VcqzYJI2/DhAa38bkB40Z3Jz8Zp0mvXMMfF0cEYqmnSXPYaiBFpRJjk742s
-zaya2+meE1P8+zQHiQcCAwEAAaOByDCBxTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T
-AQH/BAUwAwEB/zAdBgNVHQ4EFgQUilIROXDi5YJ2vdp6JaFbT+1P7GEwHwYDVR0j
-BBgwFoAU7iCXiz5P+S601G6kAU4wvnpA2nIwNQYIKwYBBQUHAQEEKTAnMCUGCCsG
-AQUFBzAChhlodHRwczovL2NhLm50cHBvb2wub3JnL2NhMCsGA1UdHwQkMCIwIKAe
-oByGGmh0dHBzOi8vY2EubnRwcG9vbC5vcmcvY3JsMA0GCSqGSIb3DQEBCwUAA4IB
-AQC+XthXZr1kGgfRxlP6sumbzeIFBcZgMoKlMUImjZjMdmov0ZwDAmdqO27GuhwU
-T5gVcp6D1EmgzYKTb2QgLr4pnfy28St8oF3UFD9GMZjJH4xrnE4emQqZhQBYrfSg
-KRbwZl5x9ZnYju433/6rBBfHnpoc9FyqtYF8V8OXprtiYBn/mT3gnM2otd3WJW+B
-ar9V59Au0kHSkJJR/y59TPOiXAHih2wHXTKSZgKtSI9Lgqb81TDtobY5Xf+xuMlb
-UxrW/IuQWHEC1p1hXHWYs1amxLCGFpH934uM3NladEaQaAvGOE6zYCbL54+xUvU4
-jcwQMhg44B7rPwJ5OS0d4x+G
------END CERTIFICATE-----