Bug#1142349: ca-certificates: certdata2pem.py drops S/MIME-trusted-but-TLS-distrusted CAs, breaking S/MIME verification for chains Mozilla still trusts

--=-aqtQyfU6MZcfYj0lqQ3w
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Package: ca-certificates
Version: 20260601~24.04.1
Severity: important
Tags: upstream
X-Debbugs-CC: [email protected]

Summary
=3D=3D=3D=3D=3D=3D=3D

mozilla/certdata2pem.py inspects only CKA_TRUST_SERVER_AUTH when deciding
whether to emit a root as a .crt file.  Any root Mozilla marks as
CKT_NSS_MUST_VERIFY_TRUST for TLS is silently dropped from the
ca-certificates output, even if Mozilla still marks it as
CKT_NSS_TRUSTED_DELEGATOR for CKA_TRUST_EMAIL_PROTECTION or
CKA_TRUST_CODE_SIGNING.

Mozilla now uses this asymmetric trust state as its standard mechanism
for the *gradual retirement* of legacy roots (TLS distrusted first,
S/MIME and code-signing retained for a further period).  Debian's
converter collapses that graceful retirement into a total removal,
silently breaking S/MIME verification for cert chains that Mozilla
explicitly still trusts.

Reproducer
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Trust state Mozilla actually shipped for "DigiCert Assured ID Root CA"
in the NSS bundle imported by 20260601 (from the source tarball,
mozilla/certdata.txt):

  # Trust for "DigiCert Assured ID Root CA"
  CKA_TRUST_SERVER_AUTH      CK_TRUST CKT_NSS_MUST_VERIFY_TRUST   <-- TLS d=
istrusted
  CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR   <-- S/MIM=
E still trusted
  CKA_TRUST_CODE_SIGNING     CK_TRUST CKT_NSS_MUST_VERIFY_TRUST

Post-build state on the installed system:

  $ ls /usr/share/ca-certificates/mozilla/ | grep DigiCert_Assured_ID
  DigiCert_Assured_ID_Root_G2.crt
  DigiCert_Assured_ID_Root_G3.crt          # G1 file removed entirely

  $ grep Assured_ID_Root_CA /etc/ca-certificates.conf
  !mozilla/DigiCert_Assured_ID_Root_CA.crt  # explicitly disabled

  $ grep -c "CN =3D DigiCert Assured ID Root CA$" /etc/ssl/certs/ca-certifi=
cates.crt
  0                                          # absent from system trust bun=
dle

Root cause is in mozilla/certdata2pem.py, lines 108-118 of
20260601~24.04.1:

  elif obj['CKA_TRUST_SERVER_AUTH'] =3D=3D 'CKT_NSS_TRUSTED_DELEGATOR':
      trust[obj['CKA_LABEL']] =3D True                       # emit
  elif obj['CKA_TRUST_SERVER_AUTH'] =3D=3D 'CKT_NSS_NOT_TRUSTED':
      print("UNTRUSTED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % ...)
  else:
      print("Ignoring certificate %s.  SAUTH=3D%s, EPROT=3D%s" % \
            (obj['CKA_LABEL'], obj['CKA_TRUST_SERVER_AUTH'],
             obj['CKA_TRUST_EMAIL_PROTECTION']))            # silently drop=
ped

The else branch even echoes EPROT to stderr, showing awareness of the
email trust value -- but never acts on it.  Any root Mozilla marks
CKT_NSS_MUST_VERIFY_TRUST for TLS is discarded regardless of its email
or code-signing trust state.

End-user impact reproduced:

  $ openssl verify -purpose smimesign -CApath /etc/ssl/certs \
      -untrusted verokey_intermediate.pem verokey_leaf.pem
  C =3D AU, O =3D Verokey, CN =3D Verokey Secure Email G2
  error 20 at 1 depth lookup: unable to get local issuer certificate
  error verokey_leaf.pem: verification failed

  $ openssl verify -purpose smimesign \
      -CAfile digicert_assured_id_root_ca.pem \
      -untrusted verokey_intermediate.pem verokey_leaf.pem
  verokey_leaf.pem: OK

Impact
=3D=3D=3D=3D=3D=3D

In the 20260601 upload alone, this affects at least the three DigiCert
G1 roots that the debian/changelog claims were "removed":

  - DigiCert Assured ID Root CA
  - DigiCert Global Root CA
  - DigiCert High Assurance EV Root CA

Per DigiCert's public advisory
<https://knowledge.digicert.com/general-information/digicert-root-and-inter=
mediate-ca-certificate-updates-2023>
these roots were distrusted by Mozilla and Google Chrome for TLS on
15 April 2026, but Mozilla is not scheduled to distrust them for S/MIME
until 15 April 2029.  The changelog wording ("removed") is misleading:
Mozilla did not remove them; it downgraded TLS trust while retaining
S/MIME trust.  Debian silently converts that to a full removal.

This will keep recurring.  Every future graceful CA retirement by
Mozilla (which is now the standard pattern under the CA/Browser Forum
S/MIME Baseline Requirements) will hit the same converter defect.

Downstream Ubuntu is affected identically; the same 20260601~24.04.1
upload has landed as a noble-security update and the extracted trust
bundle is byte-for-byte the result of running this script.
LP: #2156786 references this batch on the Ubuntu side.

The user-visible effects on a Debian/Ubuntu system:

  - openssl / gnutls / anything reading /etc/ssl/certs/ca-certificates.crt:
    cannot validate S/MIME signatures issued under these roots.
  - p11-kit-trust (fed by /usr/share/ca-certificates/trust-source/):
    same -- the root is gone from its input.
  - Applications that use the libnssckbi.so shipped by libnss3 directly
    (Thunderbird embeds its own copy; some Evolution / camel-smime
    configurations): behaviour depends on the libnss3 build path and
    whether the application resolves the "Mozilla Root Certs" module to
    the real Mozilla builtins or to p11-kit-trust.

Suggested fixes
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Not the simplest change:

1. Preserve trust distinctions in the output.  p11-kit-trust's native
   trust-source/ format can encode per-purpose trust flags in .p11-kit
   anchor files.  Emit these instead of / in addition to the flat .crt
   extract when a root has asymmetric trust (see p11-kit's
   pem-directory-hash extractor and trust extract --purpose=3D selectors).
   This is the "correct" fix and matches what Fedora / RHEL do.

2. At minimum, emit the .crt file into /usr/share/ca-certificates/mozilla/
   unconditionally, but keep it commented out in
   /etc/ca-certificates.conf unless *any* trust purpose is
   TRUSTED_DELEGATOR.  That preserves the raw material for downstream
   consumers (Thunderbird, NSS-based apps) without adding it to the flat
   TLS bundle.  The current behaviour deletes the source .crt file too,
   leaving nowhere to recover from.

3. Emit a separate email trust bundle -- e.g.
   /etc/ssl/certs/email-trust.crt -- for consumers that want S/MIME-only
   anchors distinct from TLS.

--=-aqtQyfU6MZcfYj0lqQ3w
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Disposition: attachment; filename="smime.p7s"
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD9Aw
ggSOMIIDdqADAgECAhAOmiw0ECVD4cWj5DqVrT9PMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT
AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi
BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yNDAxMzAwMDAwMDBaFw0zMTEx
MDkyMzU5NTlaMEExCzAJBgNVBAYTAkFVMRAwDgYDVQQKEwdWZXJva2V5MSAwHgYDVQQDExdWZXJv
a2V5IFNlY3VyZSBFbWFpbCBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMjvgLKj
jfhCFqxYyRiW8g3cNFAvltDbK5AzcOaR7yVzVGadr4YcCVxjKrEJOgi7WEOH8rUgCNB5cTD8N/Et
GfZI+LGqSv0YtNa54T9D1AWJy08ZKkWvfGGIXN9UFAPMJ6OLLH/UUEgFa+7KlrEvMUupDFGnnR06
aDJAwtycb8yXtILj+TvfhLFhafxroXrflspavejQkEiHjNjtHnwbZ+o43g0/yxjwnarGI3kgcak7
nnI9/8Lqpq79tLHYwLajotwLiGTB71AGN5xK+tzB+D4eN9lXayrjcszgbOv2ZCgzExQUAIt98mre
8EggKs9mwtEuKAhYBIP/0K6WsoMnQCcCAwEAAaOCAVwwggFYMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFIlICOogTndrhuWByNfhjWSEf/xwMB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6en
IZ3zbcgPMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIweQYI
KwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQwYIKwYB
BQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RD
QS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0
QXNzdXJlZElEUm9vdENBLmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQELBQADggEB
ACiagCqvNVxOfSd0uYfJMiZsOEBXAKIR/kpqRp2YCfrP4Tz7fJogYN4fxNAw7iy/bPZcvpVCfe/H
/CCcp3alXL0I8M/rnEnRlv8ItY4MEF+2T/MkdXI3u1vHy3ua8SxBM8eT9LBQokHZxGUX51cE0kwa
uEOZ+PonVIOnMjuLp29kcNOVnzf8DGKiek+cT51FvGRjV6LbaxXOm2P47/aiaXrDD5O0RF5SiPo6
xD1/ClkCETyyEAE5LRJlXtx288R598koyFcwCSXijeVcRvBB1cNOLEbg7RMSw1AGq14fNe2cH1HG
W7xyduY/ydQt6gv5r21mDOQ5SaZSWC/ZRfLDuEYwggWbMIIEg6ADAgECAhAH5JEPagNRXYDiRPdl
c1vgMA0GCSqGSIb3DQEBCwUAMEExCzAJBgNVBAYTAkFVMRAwDgYDVQQKEwdWZXJva2V5MSAwHgYD
VQQDExdWZXJva2V5IFNlY3VyZSBFbWFpbCBHMjAeFw0yNDEyMzAwMDAwMDBaFw0yODAxMDQyMzU5
NTlaMB4xHDAaBgNVBAMME2R3bXcyQGluZnJhZGVhZC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4IC
DwAwggIKAoICAQDali7HveR1thexYXx/W7oMk/3Wpyppl62zJ8+RmTQH4yZeYAS/SRV6zmfXlXaZ
sNOE6emg8WXLRS6BA70liot+u0O0oPnIvnx+CsMH0PD4tCKSCsdp+XphIJ2zkC9S7/yHDYnqegqt
w4smkqUqf0WX/ggH1Dckh0vHlpoS1OoxqUg+ocU6WCsnuz5q5rzFsHxhD1qGpgFdZEk2/c//ZvUN
i12vPWipk8TcJwHw9zoZ/ZrVNybpMCC0THsJ/UEVyuyszPtNYeYZAhOJ41vav1RhZJzYan4a1gU0
kKBPQklcpQEhq48woEu15isvwWh9/+5jjh0L+YNaN0I//nHSp6U9COUG9Z0cvnO8FM6PTqsnSbcc
0j+GchwOHRC7aP2t5v2stVx3KbptaYEzi4MQHxm/0+HQpMEVLLUiizJqS4PWPU6zfQTOMZ9uLQRR
ci+c5xhtMEBszlQDOvEQcyEG+hc++fH47K+MmZz21bFNfoBxLP6bjR6xtPXtREF5lLXxp+CJ6KKS
blPKeVRg/UtyJHeFKAZXO8Zeco7TZUMVHmK0ZZ1EpnZbnAhKE19Z+FJrQPQrlR0gO3lBzuyPPArV
hvWxjlO7S4DmaEhLzarWi/ze7EGwWSuI2eEa/8zU0INUsGI4ywe7vepQz7IqaAovAX0d+f1YjbmC
VsAwjhLmveFjNwIDAQABo4IBsDCCAawwHwYDVR0jBBgwFoAUiUgI6iBOd2uG5YHI1+GNZIR//HAw
HQYDVR0OBBYEFFxiGptwbOfWOtMk5loHw7uqWUOnMDAGA1UdEQQpMCeBE2R3bXcyQGluZnJhZGVh
ZC5vcmeBEGRhdmlkQHdvb2Rob3Uuc2UwFAYDVR0gBA0wCzAJBgdngQwBBQEBMA4GA1UdDwEB/wQE
AwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwewYDVR0fBHQwcjA3oDWgM4YxaHR0
cDovL2NybDMuZGlnaWNlcnQuY29tL1Zlcm9rZXlTZWN1cmVFbWFpbEcyLmNybDA3oDWgM4YxaHR0
cDovL2NybDQuZGlnaWNlcnQuY29tL1Zlcm9rZXlTZWN1cmVFbWFpbEcyLmNybDB2BggrBgEFBQcB
AQRqMGgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBABggrBgEFBQcwAoY0
aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL1Zlcm9rZXlTZWN1cmVFbWFpbEcyLmNydDANBgkq
hkiG9w0BAQsFAAOCAQEAQXc4FPiPLRnTDvmOABEzkIumojfZAe5SlnuQoeFUfi+LsWCKiB8Uextv
iBAvboKhLuN6eG/NC6WOzOCppn4mkQxRkOdLNThwMHW0d19jrZFEKtEG/epZ/hw/DdScTuZ2m7im
8ppItAT6GXD3aPhXkXnJpC/zTs85uNSQR64cEcBFjjoQDuSsTeJ5DAWf8EMyhMuD8pcbqx5kRvyt
JPsWBQzv1Dsdv2LDPLNd/JUKhHSgr7nbUr4+aAP2PHTXGcEBh8lTeYea9p4d5k969pe0OHYMV5aL
xERqTagmSetuIwolkAuBCzA9vulg8Y49Nz2zrpUGfKGOD0FMqenYxdJHgDCCBZswggSDoAMCAQIC
EAfkkQ9qA1FdgOJE92VzW+AwDQYJKoZIhvcNAQELBQAwQTELMAkGA1UEBhMCQVUxEDAOBgNVBAoT
B1Zlcm9rZXkxIDAeBgNVBAMTF1Zlcm9rZXkgU2VjdXJlIEVtYWlsIEcyMB4XDTI0MTIzMDAwMDAw
MFoXDTI4MDEwNDIzNTk1OVowHjEcMBoGA1UEAwwTZHdtdzJAaW5mcmFkZWFkLm9yZzCCAiIwDQYJ
KoZIhvcNAQEBBQADggIPADCCAgoCggIBANqWLse95HW2F7FhfH9bugyT/danKmmXrbMnz5GZNAfj
Jl5gBL9JFXrOZ9eVdpmw04Tp6aDxZctFLoEDvSWKi367Q7Sg+ci+fH4KwwfQ8Pi0IpIKx2n5emEg
nbOQL1Lv/IcNiep6Cq3DiyaSpSp/RZf+CAfUNySHS8eWmhLU6jGpSD6hxTpYKye7PmrmvMWwfGEP
WoamAV1kSTb9z/9m9Q2LXa89aKmTxNwnAfD3Ohn9mtU3JukwILRMewn9QRXK7KzM+01h5hkCE4nj
W9q/VGFknNhqfhrWBTSQoE9CSVylASGrjzCgS7XmKy/BaH3/7mOOHQv5g1o3Qj/+cdKnpT0I5Qb1
nRy+c7wUzo9OqydJtxzSP4ZyHA4dELto/a3m/ay1XHcpum1pgTOLgxAfGb/T4dCkwRUstSKLMmpL
g9Y9TrN9BM4xn24tBFFyL5znGG0wQGzOVAM68RBzIQb6Fz758fjsr4yZnPbVsU1+gHEs/puNHrG0
9e1EQXmUtfGn4InoopJuU8p5VGD9S3Ikd4UoBlc7xl5yjtNlQxUeYrRlnUSmdlucCEoTX1n4UmtA
9CuVHSA7eUHO7I88CtWG9bGOU7tLgOZoSEvNqtaL/N7sQbBZK4jZ4Rr/zNTQg1SwYjjLB7u96lDP
sipoCi8BfR35/ViNuYJWwDCOEua94WM3AgMBAAGjggGwMIIBrDAfBgNVHSMEGDAWgBSJSAjqIE53
a4blgcjX4Y1khH/8cDAdBgNVHQ4EFgQUXGIam3Bs59Y60yTmWgfDu6pZQ6cwMAYDVR0RBCkwJ4ET
ZHdtdzJAaW5mcmFkZWFkLm9yZ4EQZGF2aWRAd29vZGhvdS5zZTAUBgNVHSAEDTALMAkGB2eBDAEF
AQEwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDB7BgNVHR8E
dDByMDegNaAzhjFodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vVmVyb2tleVNlY3VyZUVtYWlsRzIu
Y3JsMDegNaAzhjFodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vVmVyb2tleVNlY3VyZUVtYWlsRzIu
Y3JsMHYGCCsGAQUFBwEBBGowaDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t
MEAGCCsGAQUFBzAChjRodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vVmVyb2tleVNlY3VyZUVt
YWlsRzIuY3J0MA0GCSqGSIb3DQEBCwUAA4IBAQBBdzgU+I8tGdMO+Y4AETOQi6aiN9kB7lKWe5Ch
4VR+L4uxYIqIHxR7G2+IEC9ugqEu43p4b80LpY7M4KmmfiaRDFGQ50s1OHAwdbR3X2OtkUQq0Qb9
6ln+HD8N1JxO5nabuKbymki0BPoZcPdo+FeRecmkL/NOzzm41JBHrhwRwEWOOhAO5KxN4nkMBZ/w
QzKEy4PylxurHmRG/K0k+xYFDO/UOx2/YsM8s138lQqEdKCvudtSvj5oA/Y8dNcZwQGHyVN5h5r2
nh3mT3r2l7Q4dgxXlovERGpNqCZJ624jCiWQC4ELMD2+6WDxjj03PbOulQZ8oY4PQUyp6djF0keA
MYIDuzCCA7cCAQEwVTBBMQswCQYDVQQGEwJBVTEQMA4GA1UEChMHVmVyb2tleTEgMB4GA1UEAxMX
VmVyb2tleSBTZWN1cmUgRW1haWwgRzICEAfkkQ9qA1FdgOJE92VzW+AwDQYJYIZIAWUDBAIBBQCg
ggE3MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI2MDcxODEwMTAw
MVowLwYJKoZIhvcNAQkEMSIEIFE8CrgTj99TunNVY/VRqgjZ7Thryi60zkrxE+b8R/LpMGQGCSsG
AQQBgjcQBDFXMFUwQTELMAkGA1UEBhMCQVUxEDAOBgNVBAoTB1Zlcm9rZXkxIDAeBgNVBAMTF1Zl
cm9rZXkgU2VjdXJlIEVtYWlsIEcyAhAH5JEPagNRXYDiRPdlc1vgMGYGCyqGSIb3DQEJEAILMVeg
VTBBMQswCQYDVQQGEwJBVTEQMA4GA1UEChMHVmVyb2tleTEgMB4GA1UEAxMXVmVyb2tleSBTZWN1
cmUgRW1haWwgRzICEAfkkQ9qA1FdgOJE92VzW+AwDQYJKoZIhvcNAQEBBQAEggIAsb2qM95hvL6/
/y6/LuCJazTSFMM66gJ6C36PagjxBMVTkiUA69s4FhwZ0cFrbmKIbsNRdw8xKVuVKRahGyYmYN7w
2yxa5AVVU4Za9c46CbNMSP87+YFOZtZD/fuUp0xeM6EIzyLX/odB8Vsrc3pw6cLB9BC5VAWhR3ot
cSoZUXFlJ/q7jslqBbuBOkfXOEfzDG0Q9OecydL/ezxUbkgmnLDUQfprqdkZxAQA0RcX6XFegmNp
4jUqnIQsOhC62gYqhiLDspvcrrWuyOeKsR9rSaRXAJIH9hfthcCf6Z/Zym1sNp7o7pDGItfNzUmK
kfFaDyXq0vD1jMXMrMsxSLaRH6SSiIsKIRGyo8DznIBzhKSDWTbZwSZGGWkdgewTmpcfJbJPH69y
6sChAMAeyi78J+U0u4HfATrkIN0ydyZvxWMKcXNx6YyAhAWSw/4KmXRa7OUgSwr+LW2e34Ov1viO
n0qF0TflRFakt9nsSR1IE4LJg/FJUN48kaeJKDHVXxbybiQZWCatTHSOtLsJWOoXA1sgrnh6isTI
DzBlHYsvfrqTJBV9GzA7jGdScjqbCBQHDrxR+XQU/bVyhxDsTrwWrdQQsic2qhFDvvcWOKcpzVTg
bEQGtSBDIEx6nZ+M+Si5+L7n4XbOFhTYtsDrpmabfGqcfXorftyYGDK3MAaqqp8AAAAAAAA=


--=-aqtQyfU6MZcfYj0lqQ3w--