Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package java-21-openjdk for openSUSE:Factory
checked in at 2026-10-28 17:45:21
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/java-21-openjdk (Old)
and /work/SRC/openSUSE:Factory/.java-21-openjdk.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "java-21-openjdk"
Wed Oct 28 17:45:21 2026 rev:29 rq:1393088 version:21.0.13.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/java-21-openjdk/java-21-openjdk.changes
2026-08-27 18:49:25.388498531 +0200
+++
/work/SRC/openSUSE:Factory/.java-21-openjdk.new.2252680/java-21-openjdk.changes
2026-10-28 17:45:33.849594097 +0100
@@ -1,0 +2,285 @@
+Tue Oct 27 12:46:00 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Update to upstream tag jdk-21.0.13+9 (Octobre 2026 CPU)
+ * Security fixes
+ + JDK-8383530: Enhance Javadoc Searching
+ + JDK-8383679, CVE-2026-87294, bsc#1286490: Enhance Certificate
+ Name Checks
+ + JDK-8383439, CVE-2026-83395, bsc#1286479: Enhance HTTP Client
+ Response Handling
+ + JDK-8386783: WebRowSet empty elements read value of previous
+ element
+ + JDK-8383301, CVE-2026-83387, bsc#1286478: Enhance WebRowSets
+ + JDK-8380715, CVE-2026-83374, bsc#1286472: Enhance PKCS5
+ padding
+ + JDK-8384654, CVE-2026-87367, bsc#1286943: Enhance Template
+ Handling
+ + JDK-8384736, CVE-2026-91379, bsc#1286498: Enhance JShell
+ + JDK-8382378, CVE-2026-83378, bsc#1286475: Improve C2 loop
+ transformations
+ + JDK-8383699, CVE-2026-87290, bsc#1286484: Enhance XPath
+ Expressions
+ + JDK-8383047, CVE-2026-83380, bsc#1286476: Enhance LDAP logins
+ + JDK-8384468: Enhance jpackage Packaging
+ + JDK-8384021, CVE-2026-101516, bsc#1286395: Enhance
+ Certificate Constraint Checking
+ + JDK-8387152, CVE-2026-91462, bsc#1286547: Enhance krb5 tokens
+ + JDK-8387238, CVE-2026-91464, bsc#1286550: Enhance Kerberos
+ validation
+ + JDK-8386013: Enhance EventListenerList
+ + JDK-8382407: Enhance LDAP Lookups
+ + JDK-8390400, CVE-2026-91487, bsc#1286551: Enhance C2
+ comparisons
+ + JDK-8385209, CVE-2026-91394, bsc#1286507: Enhance HTTP client
+ caching
+ + JDK-8386535, CVE-2026-91453, bsc#1286545: Improve HTTP headers
+ + JDK-8385476, CVE-2026-91400, bsc#1286517: Enhance MIDI file
+ handling
+ + JDK-8386923, CVE-2026-91461, bsc#1286546: Enhance TLS
+ Extensions
+ + JDK-8387217, CVE-2026-91463, bsc#1286549: Enhance krb5 client
+ + JDK-8386515, CVE-2026-91451, bsc#1286542: Enhance HTTP server
+ parsing
+ + JDK-8373677: Clear text HttpServer connection could fail fast
+ if receiving SSL ClientHello
+ + JDK-8384872, CVE-2026-91332, bsc#1286491: Enhance HTTP Client
+ + JDK-8383756, CVE-2026-87292, bsc#1286486: Enhance Network
+ Clients
+ + JDK-8383745, CVE-2026-87291, bsc#1286485: Enhance HTTP Server
+ + JDK-8384165, CVE-2026-91333, bsc#1286492: Improve ciphertext
+ handling
+ + JDK-8383281: Enhance MD5 Digesting
+ + JDK-8384664, CVE-2026-91335, bsc#1286494: Enhance Image
+ Handling
+ + JDK-8384746, CVE-2026-91380, bsc#1286500: Enhance Preferences
+ + JDK-8386552, CVE-2026-91418, bsc#1286539: Enhance GIF loading
+ + JDK-8384688, CVE-2026-91375, bsc#1286497: Enhance jmod
+ handling
+ + JDK-8387075: RemoteHostImpl constructor correction (jstatd)
+ + JDK-8386525, CVE-2026-91452, bsc#1286544: Enhance HTTP Server
+ Handler
+ + JDK-8386187, CVE-2026-91415, bsc#1286537: Enhance font
+ rendering
+ + JDK-8385260, CVE-2026-91398, bsc#1286515: Enhance SOCKS5
+ support
+ + JDK-8385249, CVE-2026-91397, bsc#1286513: Enhance diagnostic
+ sessions
+ + JDK-8384930, CVE-2026-91374, bsc#1286496: Enhance jstatd
+ + JDK-8384771, CVE-2026-91373, bsc#1286495: Enhance TLS
+ handshakes
+ + JDK-8384455: Enhance DataFlavor
+ + JDK-8384445, CVE-2026-91334, bsc#1286493: Enhance JPEG loading
+ + JDK-8384031, CVE-2026-83400, bsc#1286480: Enhance XML
+ Processing
+ + JDK-8383076, CVE-2026-83381, bsc#1286477: Enhance SASL
+ Authentication
+ + JDK-8382178, CVE-2026-83376, bsc#1286474: Enhance TLS
+ certificate handling
+ * Other fixes
+ + JDK-8387235: JShell tests failing
+ + JDK-8394844: [21u] Remove designator
+ DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.13
+ + JDK-8394265: [21u] Add explicit zone offset test for
+ America/Rainy_River
+ + JDK-8393848: Align the JDK with Microsoft's new timezone name
+ for Manitoba
+ + JDK-8392538: Align the JDK with Microsoft's new timezone names
+ for British Columbia/Alberta
+ + JDK-8343788: Provide means to alter lib/tzmappings entries on
+ Windows
+ + JDK-8317126: Redundant entries in Windows `tzmappings` file
+ + JDK-8393337: (tz) Update Timezone Data to 2026e
+ + JDK-8393344: Cherry-pick metazone changes from CLDR to support
+ tzdata2026e for JDK update releases
+ + JDK-8392377: (tz) Update Timezone Data to 2026d
+ + JDK-8392519: Cherry-pick metazone changes from CLDR for
+ tzdata2026d, for JDK update release
+ + JDK-8377992: (zipfs) Align ZipFileSystem END header validation
+ with the ZipFile implementation
+ + JDK-8391807: Inconsistent TimeZone Names Displayed across JDK
+ release trains
+ + JDK-8386273: Some javax/sound/sampled tests fail on systems
+ with high CPU core number and running with high concurrency
+ + JDK-8392072: Follow-on fix for Improve certification checking
+ + JDK-8391256: TestZoneTextPrinterParser.java assertion fails
+ with expected: <Mountain Standard Time> but was: <Mountain
+ Daylight Time>
+ + JDK-8388214: (tz) Update Timezone Data to 2026c
+ + JDK-8390380: Cherry-pick metazone changes from CLDR to support
+ tzdata2026c for JDK update releases
+ + JDK-8390388: Cherry-pick tz attributes from newer CLDR data
+ for jdk25u and earlier
+ + JDK-8381379: Support std/dstOffset attributes in CLDR's
+ metazone definitions
+ + JDK-8389648: [TEST_BUG] java/awt/TextField/CaretPositionTest/
+ /CaretPositionTest.java fails in OL-9
+ + JDK-8331159: VM build without C2 fails after JDK-8180450
+ + JDK-8380223: Refactor test/jdk/sun/util/resources TestNG tests
+ to JUnit
+ + JDK-8349759: Add unit test for CertificateBuilder and
+ SimpleOCSPServer test utilities
+ + JDK-8387123: Remove LuxTrust Global Root CA
+ + JDK-8377983: (zipfs) ZipFileSystem.initCEN needlessly reads
+ END header
+ + JDK-8316391: (zipfs) ZipFileSystem.readFullyAt does not
+ tolerate short reads
+ + JDK-8379515: draft-ietf-lamps-kyber-certificates is now RFC
+ 9935
+ + JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
+ Private Key Encodings
+ + JDK-8359735: [Ubuntu 25.10] java/lang/ProcessBuilder/
+ /Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to
+ rust-coreutils
+ + JDK-8356085: AArch64: compiler stub buffer size wrongly
+ depends on ZGC
+ + JDK-8367008: Algorithm identifiers for HmacSHA* should always
+ have NULL as params
+ + JDK-8368677: acvp test should throw SkippedException when no
+ ACVP-Server available
+ + JDK-8340493: Fix some Asserts failure messages
+ + JDK-8338686: App classpath mismatch if a jar from the
+ Class-Path attribute is on the classpath
+ + JDK-8374755: ML-KEM's 12-bit decompression can be simplified
+ on aarch64
+ + JDK-8368694: PKCS11-NSS generic keys generated by DH have
+ leading zeroes stripped
+ + JDK-8189441: Define algorithm names for keys derived from
+ KeyAgreement
+ + JDK-8361125: Fix typo in onTradAbsence
+ + JDK-8351412: Add AVX-512 intrinsics for ML-KEM
+ + JDK-8347608: Optimize Java implementation of ML-KEM
+ + JDK-8347606: Optimize Java implementation of ML-DSA
+ + JDK-8353478: Update crypto microbenchmarks to cover ML-DSA,
+ ML-KEM, and HSS algorithms
+ + JDK-8354926: Remove remnants of debugging in the fix for
+ JDK-8348561 and JDK-8349721
+ + JDK-8389492: [21u] java/io/Serializable/records/
+ /ProhibitedMethods.java fails after JDK-8307843 backport in
+ othervm mode
+ + JDK-8378506: [macOS] Window content not updated when rendering
+ to multiple windows
+ + JDK-8349721: Add aarch64 intrinsics for ML-KEM
+ + JDK-8356051: Update SignatureUtil.java with the new KnownOIDs
+ + JDK-8354305: SHAKE128 and SHAKE256 MessageDigest algorithms
+ + JDK-8386578: double_keccak stub does not set its return value
+ on x86
+ + JDK-8351034: Add AVX-512 intrinsics for ML-DSA
+ + JDK-7067310: 3 tests from closed/javax/sound/sampled caused
+ BSOD on win 7 x86
+ + JDK-8307574: ClipIsRunningAfterStop.java failed with
+ "../nptl/pthread_mutex_lock.c:81: __pthread_mutex_lock:
+ Assertion `mutex->__data.__owner == 0' failed."
+ + JDK-8308395: javax/sound/sampled/Clip/ClipFlushCrash.java
+ timed out
+ + JDK-8374343: Fix SIGSEGV when lib/modules is unreadable
+ + JDK-8350589: Investigate cleaner implementation of AArch64
+ ML-DSA intrinsic introduced in JDK-8348561
+ + JDK-8349017: Update ML tests to verify against ACVP 1.1.0.38
+ version
+ + JDK-8348561: Add aarch64 intrinsics for ML-DSA
+ + JDK-8369020: Test compiler/intrinsics/
+ /TestLongUnsignedDivMod.java completed and timed out
+ + JDK-8345057: ML_KEM NamedParameterSpec constants removed by
+ ML-DSA integration
+ + JDK-8345533: Switch ML-DSA implementation to FIPS 204 final
+ + JDK-8345512: Remove wrapper functions for intrinsics in PQC
+ algorithms
+ + JDK-8298387: Implement JEP 497: Quantum-Resistant
+ Module-Lattice-Based Digital Signature Algorithm
+ + JDK-8341625: Improve ZipFile validation of the END header
+ + JDK-8298390: Implement JEP 496: Quantum-Resistant
+ Module-Lattice-Based Key Encapsulation Mechanism
+ + JDK-8342442: Static ACVP sample tests
+ + JDK-8342002: sun/security/tools/keytool/GenKeyPairSigner.java
+ failed due to missing certificate output
+ + JDK-8340327: A common framework to support public key
+ algorithms with standard parameter sets
+ + JDK-8387593: Using XOR mode to clear the content leaves some
+ traces in metal
+ + JDK-8377991: TestLimitsUpdating.java fails with runtime
+ exception even after JDK-8370492 is fixed
+ + JDK-8306281: function isWsl() returns false on WSL2
+ + JDK-8365498: jdk/jfr/event/os/TestCPULoad.java fails with
+ Expected at least one event
+ + JDK-8387625: Add "dt_socket" to
+ `CheckedFeatures.notImplemented` for Windows/ARM64
+ + JDK-8388431: [21u] Backport of JDK-8352565 misses previous vm
+ symbol to be deleted
+ + JDK-8387985: sun/tools/jstat shell tests fail on platforms
+ that do not support ParallelGC
+ + JDK-8385454: Provide more NUMA related information in
+ hsinfo/hserr files
+ + JDK-8352565: Add native method implementation of
+ Reference.get()
+ + JDK-8334502: gtest/GTestWrapper.java fails on armhf due to
+ LogDecorations.iso8601_utctime_test
+ + JDK-8372757: MacOS, Accessibility: Crash in [MenuAccessibility
+ accessibilityChildren] after JDK-8341311
+ + JDK-8384804: JMX remote bootstrap tests fail on Windows
+ + JDK-8365426: [macos26] Graphics2D tests fail on new macOS 26
+ + JDK-8382063: Jtreg test javax/swing/SwingWorker/
+ /TestDoneBeforeDoInBackground.java fails
+ + JDK-8380993: [REDO] Incorrect Interpretation of POSIX TZ
+ Environment Variable on AIX
+ + JDK-8342003: ProblemList sun/security/tools/keytool/
+ /GenKeyPairSigner.java
+ + JDK-8371893: [macOS] use dead_strip linker option to reduce
+ binary size
+ + JDK-8372615: Many container tests fail when running rootless
+ on cgroup v1
+ + JDK-8341527: AVX-512 intrinsic for SHA3
+ + JDK-8247690: RunTest does not support running of JTREG manual
+ tests
+ + JDK-8310331: JitTester: Exclude java.lang.Math.random
+ + JDK-8343739: Test java/awt/event/KeyEvent/ExtendedKeyCode/
+ /ExtendedKeyCodeTest.java failed: Wrong extended key code
+ + JDK-8338587: Internal XOF Methods for SHAKE128 and SHAKE256
+ + JDK-8376355: Update to use jtreg 8.2.1
+ + JDK-8369488: Update to use jtreg 8.1
+ + JDK-8383611: assert(count == os::processor_count() + 1)
+ failed: invalid enumeration!
+ + JDK-8378180: Compiling OpenJDK with C23 C-Compiler gives
+ warning: initialization discards ‘const’ qualifier from
+ pointer target type
+ + JDK-8333867: SHA3 performance can be improved
+ + JDK-8381771: Add a check for DNS label not to end with a
+ hyphen
+ + JDK-8374886: CAInterop.java#microsoftrsa2017 test fails as EE
+ certificate does not specify OCSP responder
+ + JDK-8385584: CAInterop.java#buypassclass3ca fails with
+ Intermediate Root CA not found in the chain
+ + JDK-8386551: Windows build broken because of MSys2/Make update
+ + JDK-8343698: Linux x86_64 lto build gives a lot of warnings
+ and fails lto-wrapper: fatal error: make returned 2 exit
+ status
+ + JDK-8384163: (so) SocketChannel.connect and finishConnect()
+ exception messages could be improved
+ + JDK-8381937: Make exceptions in
+ Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
+ more specific
+ + JDK-8386345: Remove redundant @requires from
+ TestGarbageCollectionEventWithZMinor
+ + JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when
+ copy_file_range not supported
+ + JDK-8372546: UnixMultiResolutionSplashTest.java fails
+ intermittently on Ubuntu_24.04
+ + JDK-8364106: Include java.runtime.version in thread dump
+ output
+ + JDK-8375125: assert(false) failed: "Attempting to acquire lock
+ NativeHeapTrimmer_lock/nosafepoint out of order with lock
+ ConcurrentHashTableResize_lock/nosafepoint-2 -- possible
+ deadlock" when using native heap trimmer
+ + JDK-8361950: Update to use jtreg 8
+ + JDK-8385508: Bump update version for OpenJDK: jdk-21.0.13
+- Removed patch:
+ * tzdata-2026c.patch
+ + not needed any more
+- Modified patch:
+ * fips.patch
+ + rebased
+- Added patch:
+ * JDK-8395142-21u.patch
+ + JDK-8395142, CVE-2026-91403, bsc#1287264: CA Enhancements
+ (backport of upstream fix)
+
+-------------------------------------------------------------------
Old:
----
jdk-21.0.12.1+1.tar.gz
tzdata-2026c.patch
New:
----
JDK-8395142-21u.patch
jdk-21.0.13+9.tar.gz
----------(Old B)----------
Old:- Removed patch:
* tzdata-2026c.patch
+ not needed any more
----------(Old E)----------
----------(New B)----------
New:- Added patch:
* JDK-8395142-21u.patch
+ JDK-8395142, CVE-2026-91403, bsc#1287264: CA Enhancements
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ java-21-openjdk.spec ++++++
--- /var/tmp/diff_new_pack.fFBAWU/_old 2026-10-28 17:45:38.354782667 +0100
+++ /var/tmp/diff_new_pack.fFBAWU/_new 2026-10-28 17:45:38.358782834 +0100
@@ -37,9 +37,9 @@
# Standard JPackage naming and versioning defines.
%global featurever 21
%global interimver 0
-%global updatever 12
-%global patchver 1
-%global buildver 1
+%global updatever 13
+#global patchver 0
+%global buildver 9
%global openjdk_repo jdk21u
%global openjdk_tag
jdk-%{featurever}%{?updatever:.%{interimver}.%{updatever}}%{?patchver:.%{patchver}}+%{buildver}
%global openjdk_dir
%{openjdk_repo}-jdk-%{featurever}%{?updatever:.%{interimver}.%{updatever}}%{?patchver:.%{patchver}}-%{buildver}
@@ -187,7 +187,7 @@
Patch303: java-40y.patch
Patch304: bsc-1221224.patch
#
-Patch400: tzdata-2026c.patch
+Patch400: JDK-8395142-21u.patch
#
BuildRequires: alsa-lib-devel
BuildRequires: autoconf
@@ -224,7 +224,6 @@
# Requires rest of java
Requires: %{name}-headless = %{version}-%{release}
Requires: fontconfig
-Requires(post): file
%if 0%{?suse_version} > 1315 || 0%{?java_bootstrap}
# Standard JPackage base provides.
Provides: java = %{javaver}
@@ -764,7 +763,7 @@
# check if the java-cacerts is a valid keystore (bnc#781690)
if [ X"`%{_bindir}/file --mime-type -b %{javacacerts}`" \
- != "Xapplication/x-java-keystore;" ]; then
+ != "Xapplication/x-java-keystore" ]; then
%if 0%{?suse_version} <= 1310
# workaround for bnc#847952 - pre 13.1 keyring.jar attempts to load
invalid keystore and fail on it
rm -f "%{javacacerts}"
@@ -780,7 +779,7 @@
# if cacerts does exists, neither does not contain/point to a
# valid keystore (bnc#781690) ...
if [ X"`%{_bindir}/file --mime-type -b -L %{cacerts}`" \
- != "Xapplication/x-java-keystore;" ]; then
+ != "Xapplication/x-java-keystore" ]; then
# bnc#727223
rm -f %{cacerts}
ln -s %{javacacerts} %{cacerts}
++++++ JDK-8395142-21u.patch ++++++
>From 85974eed594aa5a9e13a6a20713156ed8d9cd0ed Mon Sep 17 00:00:00 2001
From: Sergey Bylokhov <[email protected]>
Date: Thu, 22 Oct 2026 15:17:04 +0000
Subject: [PATCH] 8395142: CA Enhancements
Reviewed-by: abakhtin
Backport-of: 22bc7357ce6bc5f1ed2f1e83e0544b2c25f781d4
---
.../BlockedCertsConverter.java | 41 +-
.../blockedcertsconverter/blocked.certs.pem | 430 ++++++++++++++++++
.../sun/security/lib/CheckBlockedCerts.java | 16 +-
3 files changed, 468 insertions(+), 19 deletions(-)
diff --git
a/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
b/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
index 1b2a3ebebaf..9103f47bd4d 100644
---
a/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
+++
b/make/jdk/src/classes/build/tools/blockedcertsconverter/BlockedCertsConverter.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2013, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -27,12 +27,14 @@ package build.tools.blockedcertsconverter;
import java.io.IOException;
import java.math.BigInteger;
+import java.security.AlgorithmParameters;
+import java.security.GeneralSecurityException;
import java.security.MessageDigest;
-import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
-import java.security.interfaces.ECPublicKey;
+import java.security.spec.ECGenParameterSpec;
+import java.security.spec.ECParameterSpec;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
@@ -140,11 +142,8 @@ public class BlockedCertsConverter {
List<DerValue> algIds = Arrays.asList(seq[1], altAlgId(seq[1]));
List<DerValue> sigs;
- PublicKey p = c.getPublicKey();
- if (p instanceof ECPublicKey) {
- ECPublicKey ep = (ECPublicKey) p;
- BigInteger mod = ep.getParams().getOrder();
- sigs = Arrays.asList(seq[2], altSig(mod, seq[2]));
+ if (c.getSigAlgName().contains("ECDSA")) {
+ sigs = Arrays.asList(seq[2], altSig(seq[2]));
} else {
sigs = Arrays.asList(seq[2]);
}
@@ -163,14 +162,27 @@ public class BlockedCertsConverter {
return result;
}
- private static DerValue altSig(BigInteger mod, DerValue sig)
+ private static DerValue altSig(DerValue sig)
throws IOException {
byte[] sigBits = sig.getBitString();
+ int sigLength = sigBits.length;
DerInputStream in =
- new DerInputStream(sigBits, 0, sigBits.length, false);
+ new DerInputStream(sigBits, 0, sigLength, false);
DerValue[] values = in.getSequence(2);
BigInteger r = values[0].getBigInteger();
BigInteger s = values[1].getBigInteger();
+ BigInteger mod;
+ // The following checks cover more than 99.99999% of signature lengths
+ // for the three NIST-P curves. Fail if the length lies outside.
+ if (sigLength >= 100 && sigLength <= 104) {
+ mod = order("secp384r1");
+ } else if (sigLength >= 68 && sigLength <= 72) {
+ mod = order("secp256r1");
+ } else if (sigLength >= 135 && sigLength <= 139) {
+ mod = order("secp521r1");
+ } else {
+ throw new RuntimeException("Unrecognized signature length: " +
sigLength);
+ }
BigInteger s2 = s.negate().mod(mod);
DerOutputStream out = new DerOutputStream();
out.putInteger(r);
@@ -193,4 +205,13 @@ public class BlockedCertsConverter {
tmp.write(DerValue.tag_Sequence, bytes);
return new DerValue(tmp.toByteArray());
}
+ private static BigInteger order(String curve) throws IOException {
+ try {
+ AlgorithmParameters ap = AlgorithmParameters.getInstance("EC");
+ ap.init(new ECGenParameterSpec(curve));
+ return ap.getParameterSpec(ECParameterSpec.class).getOrder();
+ } catch (GeneralSecurityException e) {
+ throw new IOException(e);
+ }
+ }
}
diff --git a/src/java.base/share/data/blockedcertsconverter/blocked.certs.pem
b/src/java.base/share/data/blockedcertsconverter/blocked.certs.pem
index 4a3b33b0307..59b08d76b8c 100644
--- a/src/java.base/share/data/blockedcertsconverter/blocked.certs.pem
+++ b/src/java.base/share/data/blockedcertsconverter/blocked.certs.pem
@@ -747,3 +747,433 @@
lZA8SFd5CTDy3EBUU5UwzXUc5HoIRUxXSPycu3aIBWawg3sCdKiAoikScPAWj0bM
0vmsP/8QSlTOBqO+QFQ6R82BtTvBNU3qbVICV4QObsxib++FAFL56NApPqskg7Vz
LfNIAjKabHUcjbuZkmg6jr4BfYW7+oQDHCsYgADjjKGdKz/8U/fP
-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// a0:24:fd:f4:ba:66:5c:78:5c:e4:a0:20:48:38:58:b7
+-----BEGIN CERTIFICATE-----
+MIIDzjCCAragAwIBAgIRAKAk/fS6Zlx4XOSgIEg4WLcwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBEViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAATnntnASpdzxHNeUREdqFrCvV5kqzdLgOEsvCA47B5PDjuBL8mFnh5nr7BO
+L4vJf3SFumWqkR7opORbYtXMA9Vr5nizw4y03JN8okYOI4RTyJKTXSnUT5HhVga2
+PM7atGijggE1MIIBMTAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQU4h4v5xwZOQ5VS2LBICRXNSSKJRQwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDEGA1UdIAQqMCgwCAYGZ4EMAQIBMA0GCysGAQQBg44hAQABMA0GCysGAQQBg44h
+AQJkMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB
+QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQBzQ1IoqpdotM6gFrR4Q3YrKifOLeaj5XXunldpVE/vZn2TxC2y0s8oYiLR5ICE
+wqVXSB7N6BM1Mp+Nif7Jbhb2IswAfSR4Iik8+B0iRmi7lYoNlycCgHjmsjOmZaxM
+QkPmjXAJbG5f4V41OsvJZmS7lI3r0IuvEDVX3GAZ13on6IImSs9ybNpHQ7NCqkMQ
+7wH4uAO1dtpFycgJSdHaCOhHjrox2BTYGLdpUrYwY3EOAjlZ8UGgsxs7mG+xquMl
+bN1LFURwfnkVMP3T/DBIZ/ys2+lNFyxK3FlArrV4/000uTnVB1lO8oGORYdXoT5V
+GUyRCEIDhF5TBUuKF4E3kf1h
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// d8:f8:68:5e:4f:2b:d9:d8:24:02:a8:5a:1c:1e:b7:31
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIRANj4aF5PK9nYJAKoWhwetzEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBFViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAQl26haZNOX2gsQUunqVG5Ie+/qnJ2daKDF6tz+73Wmm7XW/AH0K/vKbrQL
+zWTAdn42/9Bdl6gTxaoMbJUw55z18IZkaPE4BkIKpchRhAseJSVA55DktlTDhS7W
+SvHoZX2jggE0MIIBMDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUPtwg2YlGmId7hz/YgUeyXBXYRwYwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDAGA1UdIAQpMCcwBwYFZ4EMAQEwDQYLKwYBBAGDjiEBAAEwDQYLKwYBBAGDjiEB
+AngwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFB
+Q2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUF
+BzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQADggEB
+AJNFuAFW9Gnw/8+kCO4KIlZdnM1Sh2u+8cK0EYAHhXpb5FlGvYkcARigo5oS7VoM
+7FOYlTueV6yICZKNAYawZPJPhNCGK+rp3cQBEz6d0n8OZEYZov9lb3ll8ORgSDuf
+FVIW6Gagg/UnOamLBTOR8eD5V73SCme/B2cHUDw+m5E8cc+0Ujzz3Cn3ex5JrhXk
+2T3s8PoVzEmhTgGboFfcWO1EYhPPrYwdxPYRQIXAXUXhLEOVNL9ASbZJLFI8E1IM
+m7NwxVN2s38jWpaCUaaF0tg7hfiy7oe13rzJfHsdqldJVTTUTPWVx8TC4ju0VLet
+bAlwhwFT6AP8uIVMGUHNw24=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// e9:42:23:bd:e9:2f:91:4e:5a:b9:ac:ab:fd:ac:37:10
+-----BEGIN CERTIFICATE-----
+MIIDzjCCAragAwIBAgIRAOlCI73pL5FOWrmsq/2sNxAwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVkaHJhIEJW
+MRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK56Ks1xwy
+Ko42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDftDIVOTMEv
+TPhkbQ2jggE1MIIBMTAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDEGA1UdIAQqMCgwCAYGZ4EMAQICMA0GCysGAQQBg44hAQABMA0GCysGAQQBg44h
+AQJuMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FB
+QUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEF
+BQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IB
+AQALRoOSvkzRa+tN5Rje9W5GiXd/qsicd9N6Gnh0SWC7VyWH+HycIqAnFCMYZznj
+CeGusomFYHE42SHWr85JDIbgzy6y3dO4i9n9w0Bx7yrXWBbDzFS8VgA3+EY4Cg7y
+mtoC3RPOJVtaXXPZ+68X804g1Mj+3vCSHj2lNPVgco0OzSIOJ/KMg1R9MLBkiKzb
+bERAGZHejY0HBhYd76IINZN8z6bBNah2UdFYxsOisLynPQUkol6gRLum024/FzVl
+CCDfnUusrkr+mAfPAvD/Vb8bhpA7jYtepuU+2mIdShj5lLlvAwZphn+ypWycuo2x
+0k9mldz2dqI9nhCiY+TTIOOR
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 91:f3:47:f1:a5:b7:d3:99:62:b9:5e:0e:e4:e2:99:d1
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIRAJHzR/Glt9OZYrleDuTimdEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0CAQYFK4EE
+ACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFypDPjYw8C
+vRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpVbMyLpQVh
+3xsqRB0Bo4IBNTCCATEwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQw
+HQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMA4GA1UdDwEB/wQEAwIBBjAS
+BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjAxBgNVHSAEKjAoMAgGBmeBDAECATANBgsrBgEEAYOOIQEAATANBgsrBgEEAYOO
+IQECZDBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9B
+QUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYB
+BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOC
+AQEAr7b6Mx11TIJgVzHt6EH5qGNWeiiqoMrp8E5/k8s+jvupx1n083pZ5XOzUzND
+wEUe0W4C4FIGUHNQ4XDwqOw0yK42xqm2dvCKgsko2UvDlT0haZVtTCeWMQOe5J/J
+ziaMfZwsZNfZ3aaI6XPtWDZtwY8AaNfyaeCpbtm5GcGnyNWk4jSNpbtpo6NjfXuP
+CFOm3rTjJ4zytP7Tso6iMm0L01cYFOlTmoPv4515R2r3SPnKDtijoB/D/vgxzojv
+DafgyG9afX8+laO9NbMMz4sqC1vZx3984i/sBNFiugm3Vvdq5OdJRjuGC1QILIs6
+dg/K3i8VQqRpbfaM9kIlMzZ3dQ==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 8d:5a:48:11:93:9e:f4:47:d7:71:11:cd:d9:84:9a:e9
+-----BEGIN CERTIFICATE-----
+MIIDzzCCAregAwIBAgIRAI1aSBGTnvRH13ERzdmEmukwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0CAQYFK4EE
+ACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZfjpRIOHv
+1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+N7ulaVSf
+HAKycO1no4IBNTCCATEwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQw
+HQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMA4GA1UdDwEB/wQEAwIBBjAS
+BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjAxBgNVHSAEKjAoMAgGBmeBDAECAjANBgsrBgEEAYOOIQEAATANBgsrBgEEAYOO
+IQECbjBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9B
+QUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYB
+BQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOC
+AQEAHlbhZpjhkPEAQVhPHRtBDaHqiisVD20pQ1TUeSx3l62Qe7NQ0b7vWQy7DN0i
+KOu7BGpP5EnIjvXbz9FhpfPJ4FhKEt3tQ51rqXz2oD8vRaryvExWPobDUz3j7HN6
+OzBsVMIe3PD7AAkpky0x8zMSi/ep5R9OMzybmNptbtppyuB5ytgq+h7lQdRIP+CQ
+TaJX3qTgfMqzntYre5GljmEB5hU2/rSn8zoSU2APkJidlZFpghtgbD4I2VRHZvCw
+FFr/SrFM9pwrgbJNZ1MtyTSVgI5NlNb0aMfLR+/r6jJt3ROeY2yh2QQ2dx+Yqgdb
+uL5ChFWOQU+ErSDnUq7yr+pjBQ==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// d6:a5:ef:61:3b:39:0f:32:ef:9c:df:34:9f:77:28:41
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIRANal72E7OQ8y75zfNJ93KEEwDQYJKoZIhvcNAQELBQAw
+ezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
+BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0yNTA1MTQwMDAwMDBaFw0y
+ODEyMzEyMzU5NTlaMD8xCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVkaHJhIElu
+YzEaMBgGA1UEAwwRRU0gT1YgQ1MgQ0EgLSBHM0MwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAS58OBjRwKmnKaq3UQ8/WLEG5uksgkkaX15dOdpGhJvuWr7PjTC/TvF9IMG
+HyZdwqWENjRzI1EENrKPBPOGI2MGeYDiUD4CUy1lRiNacWWiWaHvSW90G1/e53hy
+COS4+u+jggEsMIIBKDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQU7m9zKY1vv6ezG8OVNPYVVkR4ZrcwDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwMgYDVR0gBCsw
+KTAIBgZngQwBBAEwDQYLKwYBBAGDjiEBAAEwDgYMKwYBBAGDjiEBAoFIMEMGA1Ud
+HwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmlj
+YXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0
+cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBgGbZ+NDkn
+2Fr5dCVs/51+6cT5iEPP1stglX4TI2UaNh9LmPdltxXw3crV8gK5L8i+d+ScGibF
+y0obtBHNTldXDgLnAHIzY3n+pceyKj7O2ae9CYnyuu5RBifeI3XYKowWE+oXnVGF
+Oy0CvCJ/JsdP6aYgoCa9hGnAYicYQQL6MOMQZ5PuhcSM8t4giIzrpgrEkUP93GYE
+emDG5Z8BYwKs80lLeQNBnwg/VHJ3iEF/o84RXYwrlrKqJ+33C094o6LNikMJCqOK
+/WYHZSR8Xyhf8GXFAj5pZuI6Bcpug2V/E7i42j8OBhc25aNYDqK+B0qmb90sjNUB
+g3tJeSIb/599
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 41:e3:2b:73:ac:18:5d:6c:e0:d7:48:0b:ac:f8:4e:69
+-----BEGIN CERTIFICATE-----
+MIIDwzCCAqugAwIBAgIQQeMrc6wYXWzg10gLrPhOaTANBgkqhkiG9w0BAQsFADB7
+MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
+VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE
+AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTI1MDUxNDAwMDAwMFoXDTI4
+MTIzMTIzNTk1OVowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRocmEgQlYx
+GjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYFK4EEACID
+YgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUObNKBDHK/+
+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jordd7EAZPKr
+5eBQo4IBLDCCASgwHwYDVR0jBBgwFoAUoBEKIz6W8Qfs4q8p74Klf9AwpLQwHQYD
+VR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMA4GA1UdDwEB/wQEAwIBBjASBgNV
+HRMBAf8ECDAGAQH/AgEAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDIGA1UdIAQrMCkw
+CAYGZ4EMAQQBMA0GCysGAQQBg44hAQABMA4GDCsGAQQBg44hAQKBSDBDBgNVHR8E
+PDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BQUFDZXJ0aWZpY2F0
+ZVNlcnZpY2VzLmNybDA0BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6
+Ly9vY3NwLmNvbW9kb2NhLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAIh0OzWsdBYhY
+7+yxPGyosRL+uUSN6/Mrd30fBuougs5FVWQ3cRgLhImnUUgXADY9buugWhMmfT3c
+yU5T1MFXZXClCILm5mfg+oqm/ikUWJl3Ayf2GvYf2O++6vzqvkn418nI5Lpdt0O7
+Li524YS/3CZHDA+zZQ7rrHpZXgQ9Hmp8AUQ4FneaGjNanFoYxiZxwCyW5z4u7AoK
+0bmOVqKtcDFoVNz5++G9TYDJdhWOXmKKgzqRo1MK0PjazNT7MGHqknP93SqMVJ1g
+mX/qNWxYteAjlvFanQxBNX/+TRxDjuFsEHO/7BvqSpIIck0UEEfizhN8zNpWLbcl
+EqVgl0g39A==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// a4:ae:e6:78:f2:33:62:b4:c0:e4:60:b7:72:f2:14
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1
+NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J
+hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p
+1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO
+Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8
+gt2TlfJbHii+KNvK
+-----END CERTIFICATE-----
+
+// Subject: CN=EM DV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 58:8b:2e:3c:2b:b8:cd:a1:3e:1a:12:09:25:43:21
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1
+MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy
+pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV
+bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg
+yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd
+AEKwaJ0mVzScy2+6
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// c7:c4:1e:fe:92:d8:25:f0:5e:ae:84:1a:4a:82:c1
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw
+MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB
+9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ
+5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA
+lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6
+MN/P+ByGeiRMghzB
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 80:09:92:8a:64:10:76:01:af:05:fa:2f:19:f1:09
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz
+OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11
+ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+
+bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm
+xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9
+i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq
+MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG
+AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc
+9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f
+Aal1GNxsOutLnr0Y
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root CS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 78:18:93:3f:8f:85:b4:61:9a:2b:35:fb:a8:3d:0a
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy
+N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo
+cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb
+NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord
+d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r
+zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG
+AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc
+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG
+Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At
+Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp
+Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo
+dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03
+YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9
+HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrM=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV CS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root CS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 54:4b:7f:92:2c:31:ae:22:0a:4a:92:29:16:f6:e6
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0
+MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo
+cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9
+O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb
+X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN
+q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr
+BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW
+HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG
+BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw
+LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z
+aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl
+aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E
+BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg
+8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg
+euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0=
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 6c:ad:a3:67:fb:1c:10:00:88:12:0e:a2:02:d5:68
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw
+MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk
+aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB
+BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK
+56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft
+DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ
+QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo
+BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE
+AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc
+28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe
+8Dz3bQjauvy9uw==
+-----END CERTIFICATE-----
+
+// Subject: CN=EM OV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=emSign Root TLS CA - G3, O=eMudhra Technologies Limited, C=IN
+// Serial Number:
+// 29:69:26:c2:27:a3:a1:52:63:92:b1:94:82:a5:04
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPKWkmwiejoVJjkrGUgqUEMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM3
+NDFaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gT1YgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEE4JRzVKskpjByKrZdzId65fnCb0LTKCspV3IrVHc/J0ViaFZ
+fjpRIOHv1jHGPhg1ysrimGmmLhYx6KKBgatWYW3EXZGKvAnzqw5jz3kqpNztc4e+
+N7ulaVSfHAKycO1no4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFDTq6gzryQra+dDF4u2beMmHnhtsMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAm4wCAYGZ4EMAQICMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNT1ZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMSZt2xsPeumRdeSMSQ3CbzIZeQ/q7GDCWfeE1Pq+mhgA6gRM44c
+NVF3xJ+wsxJk+wIwFJbaDMokD8Ei6eNOiA8yUMYvfzQyngmrhZQMdPCK1SewrR79
+4rSb9vGqxZzelQth
+-----END CERTIFICATE-----
+
+// Subject: CN=EM EV TLS CA - G3C, O=eMudhra Inc, C=US
+// Issuer: CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford,
ST=Greater Manchester, C=GB
+// Serial Number:
+// 05:f0:78:75:2d:ec:e7:a1:bb:85:95:d3:03:16:71:71
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIQBfB4dS3s56G7hZXTAxZxcTANBgkqhkiG9w0BAQsFADB7
+MQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
+VQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE
+AwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTI1MDUxNDAwMDAwMFoXDTI4
+MTIzMTIzNTk1OVowQDELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRocmEgSW5j
+MRswGQYDVQQDDBJFTSBFViBUTFMgQ0EgLSBHM0MwdjAQBgcqhkjOPQIBBgUrgQQA
+IgNiAAQtVugppvuCxkpGl9lgr5UekGeukfkm00MG2kioqut4abamfm0nQm4EQqoD
+s24ZiN/2NlFO4c8H9bpLP/KgZkWufTHVhmrTGqPSRusLMXfumct1ZsUWznSAimaP
+kfDEf8qjggE0MIIBMDAfBgNVHSMEGDAWgBSgEQojPpbxB+zirynvgqV/0DCktDAd
+BgNVHQ4EFgQUpiVegKlNt/OWfBvHkd+SvO5L618wDgYDVR0PAQH/BAQDAgEGMBIG
+A1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MDAGA1UdIAQpMCcwBwYFZ4EMAQEwDQYLKwYBBAGDjiEBAAEwDQYLKwYBBAGDjiEB
+AngwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFB
+Q2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUF
+BzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQADggEB
+AIFfHiaMSjnrdZygRYV4ekRBmG7ybcFk4hGQWMMyMFi0cAEk2+dGfz5bl8IaIbLq
+z+uVJzhOgVEX7WqIfgbWfFsfPYHYjPHBmy7SlZ3BwA86IQ6qF/etpX2/qL9A5yRN
+N3nVowUpaqV6H3aCpkAh3wR2ZNkvAbLDvPz3J0l+sEWjWv+ZISOV4R+hXDTdPXV0
+1lKxnbwqEsdo/sE2QkCDKwFrZh/0uKjWspydJj+jSaDLTrGNx50Dgmn7VEcD1ZI5
+FXjknVUiO25YlmS1dtVZSBbyUKSjlrP/yDwPcZunoAsmCAAtCKsFLviLaymzvsKI
+eSSDGxpSySp2VCxompGDk8g=
+-----END CERTIFICATE-----
diff --git a/test/jdk/sun/security/lib/CheckBlockedCerts.java
b/test/jdk/sun/security/lib/CheckBlockedCerts.java
index 5afbf4b610b..f739b022bb2 100644
--- a/test/jdk/sun/security/lib/CheckBlockedCerts.java
+++ b/test/jdk/sun/security/lib/CheckBlockedCerts.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2026, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -56,21 +56,19 @@ public class CheckBlockedCerts {
}
}
- // All certs in the pem files
- Set<Certificate> blocked = new HashSet<>();
-
// Assumes the full src is available
File blockedCertsFile = new File(System.getProperty("test.src"),
"../../../../../src/java.base/share/data/blockedcertsconverter/blocked.certs.pem");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
+ int expectedCount = 0;
try (FileInputStream fis = new FileInputStream(blockedCertsFile)) {
Collection<? extends Certificate> certs
= cf.generateCertificates(fis);
System.out.println(certs.size());
for (Certificate c: certs) {
- blocked.add(c);
X509Certificate cert = ((X509Certificate)c);
+ expectedCount += cert.getSigAlgName().contains("ECDSA") ? 4 :
2;
if (!UntrustedCertificates.isUntrusted(cert)) {
System.out.println(cert.getSubjectX500Principal() +
" is trusted");
@@ -101,11 +99,11 @@ public class CheckBlockedCerts {
failed = true;
}
// There are two unique fingerprints for each RSA certificate
- if (ccount != blocked.size() * 2
- && !blocked.isEmpty()) {
+ if (ccount != expectedCount
+ && expectedCount != 0) {
System.out.println("Wrong blocked.certs size: "
- + ccount + " fingerprints, "
- + blocked.size() + " certs");
+ + ccount + " fingerprints, expected"
+ + expectedCount);
failed = true;
}
}
--
2.56.0
++++++ fips.patch ++++++
--- /var/tmp/diff_new_pack.fFBAWU/_old 2026-10-28 17:45:38.561791332 +0100
+++ /var/tmp/diff_new_pack.fFBAWU/_new 2026-10-28 17:45:38.567791583 +0100
@@ -204,7 +204,7 @@
import static sun.security.util.SecurityConstants.PROVIDER_VER;
import static sun.security.util.SecurityProviderConstants.*;
-@@ -82,6 +83,10 @@ import static sun.security.util.SecurityProviderConstants.*;
+@@ -84,6 +85,10 @@ import static sun.security.util.SecurityProviderConstants.*;
public final class SunJCE extends Provider {
@@ -215,7 +215,7 @@
@java.io.Serial
private static final long serialVersionUID = 6812507587804302833L;
-@@ -147,301 +152,302 @@ public final class SunJCE extends Provider {
+@@ -149,301 +154,302 @@ public final class SunJCE extends Provider {
void putEntries() {
// reuse attribute map and reset before each reuse
HashMap<String, String> attrs = new HashMap<>(3);
@@ -813,7 +813,7 @@
/*
* Algorithm parameter generation engines
-@@ -450,15 +456,17 @@ public final class SunJCE extends Provider {
+@@ -452,15 +458,17 @@ public final class SunJCE extends Provider {
"DiffieHellman",
"com.sun.crypto.provider.DHParameterGenerator",
null);
@@ -840,7 +840,7 @@
/*
* Algorithm Parameter engines
-@@ -628,10 +636,10 @@ public final class SunJCE extends Provider {
+@@ -630,10 +638,10 @@ public final class SunJCE extends Provider {
"com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128");
ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128",
@@ -853,7 +853,7 @@
ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256",
"com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256");
-@@ -654,136 +662,137 @@ public final class SunJCE extends Provider {
+@@ -656,153 +664,154 @@ public final class SunJCE extends Provider {
ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256",
"com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256");
@@ -962,6 +962,23 @@
- "|java.security.interfaces.XECKey");
- ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs);
-
+- attrs.clear();
+- attrs.put("ImplementedIn", "Software");
+- ps("KEM", "ML-KEM", "com.sun.crypto.provider.ML_KEM_Impls$K", null,
attrs);
+- psA("KEM", "ML-KEM-512", "com.sun.crypto.provider.ML_KEM_Impls$K2",
attrs);
+- psA("KEM", "ML-KEM-768", "com.sun.crypto.provider.ML_KEM_Impls$K3",
attrs);
+- psA("KEM", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$K5",attrs);
+-
+- ps("KeyPairGenerator", "ML-KEM",
"com.sun.crypto.provider.ML_KEM_Impls$KPG", null, attrs);
+- psA("KeyPairGenerator", "ML-KEM-512",
"com.sun.crypto.provider.ML_KEM_Impls$KPG2", attrs);
+- psA("KeyPairGenerator", "ML-KEM-768",
"com.sun.crypto.provider.ML_KEM_Impls$KPG3", attrs);
+- psA("KeyPairGenerator", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$KPG5", attrs);
+-
+- ps("KeyFactory", "ML-KEM", "com.sun.crypto.provider.ML_KEM_Impls$KF",
null, attrs);
+- psA("KeyFactory", "ML-KEM-512",
"com.sun.crypto.provider.ML_KEM_Impls$KF2", attrs);
+- psA("KeyFactory", "ML-KEM-768",
"com.sun.crypto.provider.ML_KEM_Impls$KF3", attrs);
+- psA("KeyFactory", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$KF5", attrs);
+-
- /*
- * SSL/TLS mechanisms
- *
@@ -1092,6 +1109,23 @@
+ "|java.security.interfaces.XECKey");
+ ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs);
+
++ attrs.clear();
++ attrs.put("ImplementedIn", "Software");
++ ps("KEM", "ML-KEM", "com.sun.crypto.provider.ML_KEM_Impls$K",
null, attrs);
++ psA("KEM", "ML-KEM-512",
"com.sun.crypto.provider.ML_KEM_Impls$K2", attrs);
++ psA("KEM", "ML-KEM-768",
"com.sun.crypto.provider.ML_KEM_Impls$K3", attrs);
++ psA("KEM", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$K5",attrs);
++
++ ps("KeyPairGenerator", "ML-KEM",
"com.sun.crypto.provider.ML_KEM_Impls$KPG", null, attrs);
++ psA("KeyPairGenerator", "ML-KEM-512",
"com.sun.crypto.provider.ML_KEM_Impls$KPG2", attrs);
++ psA("KeyPairGenerator", "ML-KEM-768",
"com.sun.crypto.provider.ML_KEM_Impls$KPG3", attrs);
++ psA("KeyPairGenerator", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$KPG5", attrs);
++
++ ps("KeyFactory", "ML-KEM",
"com.sun.crypto.provider.ML_KEM_Impls$KF", null, attrs);
++ psA("KeyFactory", "ML-KEM-512",
"com.sun.crypto.provider.ML_KEM_Impls$KF2", attrs);
++ psA("KeyFactory", "ML-KEM-768",
"com.sun.crypto.provider.ML_KEM_Impls$KF3", attrs);
++ psA("KeyFactory", "ML-KEM-1024",
"com.sun.crypto.provider.ML_KEM_Impls$KF5", attrs);
++
+ /*
+ * SSL/TLS mechanisms
+ *
@@ -1750,33 +1784,39 @@
attrs.clear();
attrs.put("ImplementedIn", "Software");
-@@ -196,9 +204,11 @@ public final class SunEntries {
+@@ -201,11 +209,13 @@ public final class SunEntries {
+ attrs.clear();
attrs.put("ImplementedIn", "Software");
- attrs.put("KeySize", "2048"); // for DSA KPG and APG only
- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
+- attrs.put("KeySize", "2048");
- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
+- attrs.remove("KeySize");
+ if (!systemFipsEnabled) {
+ String dsaKPGImplClass =
"sun.security.provider.DSAKeyPairGenerator$";
+ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
++ attrs.put("KeySize", "2048");
+ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass,
attrs);
++ attrs.remove("KeySize");
+ }
+ add(p, "KeyPairGenerator", "ML-DSA",
"sun.security.provider.ML_DSA_Impls$KPG", attrs);
+ addWithAlias(p, "KeyPairGenerator", "ML-DSA-44",
"sun.security.provider.ML_DSA_Impls$KPG2", attrs);
+@@ -229,50 +239,52 @@ public final class SunEntries {
/*
- * Algorithm Parameter Generator engines
-@@ -213,44 +223,46 @@ public final class SunEntries {
- addWithAlias(p, "AlgorithmParameters", "DSA",
- "sun.security.provider.DSAParameters", attrs);
-
-- /*
-- * Key factories
-- */
+ * Key factories
+ */
- addWithAlias(p, "KeyFactory", "DSA",
- "sun.security.provider.DSAKeyFactory", attrs);
- addWithAlias(p, "KeyFactory", "HSS/LMS",
- "sun.security.provider.HSS$KeyFactoryImpl", attrs);
-
+ add(p, "KeyFactory", "ML-DSA",
"sun.security.provider.ML_DSA_Impls$KF", attrs);
+ addWithAlias(p, "KeyFactory", "ML-DSA-44",
"sun.security.provider.ML_DSA_Impls$KF2", attrs);
+ addWithAlias(p, "KeyFactory", "ML-DSA-65",
"sun.security.provider.ML_DSA_Impls$KF3", attrs);
+ addWithAlias(p, "KeyFactory", "ML-DSA-87",
"sun.security.provider.ML_DSA_Impls$KF5", attrs);
+
- /*
- * Digest engines
- */
@@ -1787,9 +1827,6 @@
- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
- attrs);
+ if (!systemFipsEnabled) {
-+ /*
-+ * Key factories
-+ */
+ addWithAlias(p, "KeyFactory", "DSA",
+ "sun.security.provider.DSAKeyFactory", attrs);
+ addWithAlias(p, "KeyFactory", "HSS/LMS",
@@ -1815,6 +1852,10 @@
- "sun.security.provider.SHA3$SHA384", attrs);
- addWithAlias(p, "MessageDigest", "SHA3-512",
- "sun.security.provider.SHA3$SHA512", attrs);
+- addWithAlias(p, "MessageDigest", "SHAKE128-256",
+- "sun.security.provider.SHA3$SHAKE128Hash", attrs);
+- addWithAlias(p, "MessageDigest", "SHAKE256-512",
+- "sun.security.provider.SHA3$SHAKE256Hash", attrs);
+ /*
+ * Digest engines
+ */
@@ -1845,10 +1886,15 @@
+ "sun.security.provider.SHA3$SHA384", attrs);
+ addWithAlias(p, "MessageDigest", "SHA3-512",
+ "sun.security.provider.SHA3$SHA512", attrs);
++ addWithAlias(p, "MessageDigest", "SHAKE128-256",
++ "sun.security.provider.SHA3$SHAKE128Hash", attrs);
++ addWithAlias(p, "MessageDigest", "SHAKE256-512",
++ "sun.security.provider.SHA3$SHAKE256Hash", attrs);
+ }
/*
* Certificates
+--- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
+++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
@@ -27,6 +27,7 @@ package sun.security.rsa;
@@ -2047,7 +2093,7 @@
+
--- a/src/java.base/share/lib/security/default.policy
+++ b/src/java.base/share/lib/security/default.policy
-@@ -130,6 +130,7 @@ grant codeBase "jrt:/jdk.charsets" {
+@@ -131,6 +131,7 @@ grant codeBase "jrt:/jdk.charsets" {
grant codeBase "jrt:/jdk.crypto.ec" {
permission java.lang.RuntimePermission
"accessClassInPackage.sun.security.*";
@@ -2055,7 +2101,7 @@
permission java.lang.RuntimePermission "loadLibrary.sunec";
permission java.security.SecurityPermission "putProviderProperty.SunEC";
permission java.security.SecurityPermission
"clearProviderProperties.SunEC";
-@@ -150,6 +151,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" {
+@@ -151,6 +152,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" {
permission java.util.PropertyPermission "os.name", "read";
permission java.util.PropertyPermission "os.arch", "read";
permission java.util.PropertyPermission
"jdk.crypto.KeyAgreement.legacyKDF", "read";
++++++ jdk-21.0.12.1+1.tar.gz -> jdk-21.0.13+9.tar.gz ++++++
/work/SRC/openSUSE:Factory/java-21-openjdk/jdk-21.0.12.1+1.tar.gz
/work/SRC/openSUSE:Factory/.java-21-openjdk.new.2252680/jdk-21.0.13+9.tar.gz
differ: char 13, line 1
