1013 B
CA trust regression fixtures
The public certificates embedded in tests/test_ca_trust.py exercise the October 2026 eMudhra trust-store check. They contain no private keys. emsign-g3.pem and aaa.pem are the incident's affected trust anchors; emsign-g1.pem is an unaffected emSign anchor that must remain usable. localhost-leaf.pem is a synthetic self-signed Ed25519 server certificate with CA:FALSE, generated solely to reproduce hashed non-CA certificates found in Ubuntu's OpenSSL directory; its private key was discarded. The test creates temporary PEM files from these public constants. The certificate fingerprints are the factual identity of each fixture.
Sources: the incident root list and the public Mozilla root certificates distributed in Debian's ca-certificates package. Behavioral chain verification should also cover the incident site's separate twelve published server chains.