emsign-g3-distrust 0.2.0__tar.gz

emsign_g3_distrust-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jacob Durham
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

emsign_g3_distrust-0.2.0/PKG-INFO

@@ -0,0 +1,182 @@
+Metadata-Version: 2.4
+Name: emsign-g3-distrust
+Version: 0.2.0
+Summary: Detect and deny compromised eMudhra/emSign G3 intermediate CAs (Mozilla Bug 2083449)
+Author: jacobyoby
+License: MIT
+Project-URL: Repository, https://github.com/jacobyoby/emsign-g3-distrust
+Project-URL: Mozilla Bug, https://bugzilla.mozilla.org/show_bug.cgi?id=2083449
+Keywords: security,tls,pki,suricata,emudhra
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Dynamic: license-file
+
+# Deny the compromised eMudhra / emSign G3 intermediate CAs
+
+![CI](https://github.com/jacobyoby/emsign-g3-distrust/actions/workflows/ci.yml/badge.svg)
+
+In October 2026, the private keys of **eight eMudhra intermediate CA certificates**
+were found to be trivially recoverable (P-384 keys generated with private scalars
+below 256). They were revoked `cACompromise` on 2026-10-18 and distrusted by the
+Mozilla, Chrome, Microsoft and Apple root programs — see
+[Mozilla Bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449).
+
+Because a leaked private key cannot be un-leaked, **anyone** can mint a validly-signed
+certificate for **any** domain (6 TLS keys) or **any** publisher (2 code-signing keys)
+that chains to these intermediates. Such a forgery is accepted by any client that still
+trusts the emSign G3 roots and has not received the distrust push — and a forged leaf
+need carry no revocation pointer, so a client that only checks the *leaf's* revocation
+will not catch it. This repo helps you **detect and deny** that path.
+
+> This repository deliberately contains **no private keys** — only the public
+> certificates, their fingerprints, and tooling to distrust them.
+
+## The eight compromised intermediates
+
+| CA | Type | SHA-256 | Serial |
+|----|------|---------|--------|
+| EM DV TLS CA - G3B | TLS | `42c4accd…ba1493` | A4AEE678F23362B4C0E460B772F214 |
+| EM DV TLS CA - G3C | TLS | `0164d7ce…934d19` | 588B2E3C2BB8CDA13E1A1209254321 |
+| EM EV TLS CA - G3B | TLS | `e7568fe6…333838` | C7C41EFE92D825F05EAE841A4A82C1 |
+| EM EV TLS CA - G3C | TLS | `432ec25f…0261f3` | 8009928A64107601AF05FA2F19F109 |
+| EM OV TLS CA - G3B | TLS | `98b89662…83bc25b` | 6CADA367FB1C100088120EA202D568 |
+| EM OV TLS CA - G3C | TLS | `cb6e1516…bf9c7c3f` | 296926C227A3A1526392B19482A504 |
+| EM OV CS CA - G3B | Code signing | `9e39de28…b067b4` | 7818933F8F85B4619A2B35FBA83D0A |
+| EM OV CS CA - G3C | Code signing | `4b2460a4…630b1` | 544B7F922C31AE220A4A922916F6E6 |
+
+Roots: `emSign Root TLS CA - G3` (`7dd78d5f…2746ed8d`), `emSign Root CS CA - G3`
+(`f2edaaff…aba34a5`). Full machine-readable list in [`indicators.csv`](indicators.csv),
+PEMs in [`certs/`](certs/).
+
+## Install
+
+Requires Python 3.10+ and `openssl` on PATH for distrust fingerprint checks.
+
+```bash
+pip install -e .
+emsign-g3 scan
+emsign-g3 export-indicators --verify
+```
+
+Override data paths when needed: `EMSIGN_G3_INDICATORS_CSV`, `EMSIGN_G3_CERTS_DIR`.
+
+Legacy entry points (`python3 tools/…`) remain as thin shims and work without install.
+
+## Tools
+
+- **`emsign-g3`** (CLI) — `scan`, `distrust`, `export-indicators` subcommands (see below).
+- **`tools/emsign_trust_scanner.py`** — shim for `emsign-g3 scan`.
+- **`tools/emsign_distrust.py`** — shim for `emsign-g3 distrust`.
+- **`tools/emsign-g3-distrust.rules`** — Suricata/Snort rules that drop TLS whose leaf
+  is issued by any of the eight (matches `tls.cert_issuer`). Deploy inline or behind a
+  decrypting proxy. Verified to fire on Suricata 8.
+- **`tools/suricata_livefire_test.sh`** — replays a recorded real-world handshake
+  (`tests/fixtures/`) through the rules and checks they fire. No root, no network.
+- **`tools/record_handshake_fixture.py`** — how that fixture was recorded: a TLS 1.2
+  handshake with a public researcher demo host, captured without root.
+- **`src/emsign_g3/`** — installable package; loads [`indicators.csv`](indicators.csv) via
+  `emsign_g3.indicators`.
+- **`tools/export_siem_indicators.py`** — shim for `emsign-g3 export-indicators`.
+
+## Operator playbook
+
+### Network detection (Suricata)
+
+1. Ship `tools/emsign-g3-distrust.rules` to your Suricata sensor (inline IPS or tap IDS).
+2. For passive IDS, change rule actions from `drop` to `alert` in the rules file.
+3. Validate offline before deploy:
+
+   ```bash
+   tools/suricata_livefire_test.sh
+   ```
+
+   Expect `PASS` and sid `92083401` on the recorded DV G3B fixture. Suricata must parse
+   TLS (`tls_events` > 0 in the script output).
+
+4. Correlate production alerts on `signature` containing `Bug2083449` or sid
+   `92083401`–`92083408` (see [`indicators.csv`](indicators.csv) `suricata_sid` column).
+
+### Host hardening (trust stores)
+
+1. Inventory (read-only):
+
+   ```bash
+   emsign-g3 scan
+   emsign-g3 scan --json   # MDM / fleet collection
+   ```
+
+2. Plan explicit distrust of the **eight intermediates** (dry-run first):
+
+   ```bash
+   emsign-g3 distrust
+   sudo emsign-g3 distrust --apply
+   ```
+
+   PEMs load from `certs/` by default; fingerprints are checked against `indicators.csv`.
+
+3. Roll back with `emsign-g3 distrust --undo` (add `--apply` to execute).
+
+### SIEM / SOAR indicators
+
+- **Canonical table:** [`indicators.csv`](indicators.csv) — eight compromised intermediates,
+  three related trust anchors, SHA-256 fingerprints, serials, Suricata SIDs, and
+  `tls.cert_issuer` match strings.
+- **Bulk export:**
+
+  ```bash
+  emsign-g3 export-indicators
+  emsign-g3 export-indicators --ndjson
+  emsign-g3 export-indicators --verify   # PEMs vs CSV
+  emsign-g3 export-indicators --format sigma --output-dir rules/sigma/
+  emsign-g3 export-indicators --format elastic-kql --output-dir rules/elastic/
+  emsign-g3 export-indicators --check-committed-rules
+  ```
+
+  Committed copies live under [`rules/sigma/`](rules/sigma/) and [`rules/elastic/`](rules/elastic/)
+  (regenerate with [`tools/regenerate_detection_rules.sh`](tools/regenerate_detection_rules.sh)).
+
+  Use host fields (`sha256_fingerprint`) against scanner/MDM output; use network fields
+  (`suricata.sid`, `tls_cert_issuer_match`) against Suricata `eve.json`.
+
+  **Sigma** and **Elastic KQL** exports are starter detections mapped to Suricata EVE
+  (`tls.issuerdn`, `alert.signature_id`). Tune field names before production alerting.
+
+## Releases
+
+Tagged releases (`v*`) build wheels, attach indicator bundles and rule tarballs, and
+publish to PyPI when trusted publishing is configured. See [`RELEASE.md`](RELEASE.md).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+ruff check src tests
+emsign-g3 export-indicators --verify
+emsign-g3 export-indicators --check-committed-rules
+tools/suricata_livefire_test.sh   # optional; requires Suricata
+```
+
+Keep [`indicators.csv`](indicators.csv) in sync with
+[`src/emsign_g3/data/indicators.csv`](src/emsign_g3/data/indicators.csv) (enforced by tests).
+
+## The durable fix
+
+Trust-store distrust reaches browsers via OneCRL / CRLSet and OS CA updates. The long
+tail — non-browser TLS clients, embedded devices, Java/Node/`certifi` bundles, code
+signing — updates on its own schedule. Use the scanner to find exposed clients and the
+distruster/IDS rules to deny the keys until every client has dropped the roots.

emsign_g3_distrust-0.2.0/README.md

@@ -0,0 +1,155 @@
+# Deny the compromised eMudhra / emSign G3 intermediate CAs
+
+![CI](https://github.com/jacobyoby/emsign-g3-distrust/actions/workflows/ci.yml/badge.svg)
+
+In October 2026, the private keys of **eight eMudhra intermediate CA certificates**
+were found to be trivially recoverable (P-384 keys generated with private scalars
+below 256). They were revoked `cACompromise` on 2026-10-18 and distrusted by the
+Mozilla, Chrome, Microsoft and Apple root programs — see
+[Mozilla Bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449).
+
+Because a leaked private key cannot be un-leaked, **anyone** can mint a validly-signed
+certificate for **any** domain (6 TLS keys) or **any** publisher (2 code-signing keys)
+that chains to these intermediates. Such a forgery is accepted by any client that still
+trusts the emSign G3 roots and has not received the distrust push — and a forged leaf
+need carry no revocation pointer, so a client that only checks the *leaf's* revocation
+will not catch it. This repo helps you **detect and deny** that path.
+
+> This repository deliberately contains **no private keys** — only the public
+> certificates, their fingerprints, and tooling to distrust them.
+
+## The eight compromised intermediates
+
+| CA | Type | SHA-256 | Serial |
+|----|------|---------|--------|
+| EM DV TLS CA - G3B | TLS | `42c4accd…ba1493` | A4AEE678F23362B4C0E460B772F214 |
+| EM DV TLS CA - G3C | TLS | `0164d7ce…934d19` | 588B2E3C2BB8CDA13E1A1209254321 |
+| EM EV TLS CA - G3B | TLS | `e7568fe6…333838` | C7C41EFE92D825F05EAE841A4A82C1 |
+| EM EV TLS CA - G3C | TLS | `432ec25f…0261f3` | 8009928A64107601AF05FA2F19F109 |
+| EM OV TLS CA - G3B | TLS | `98b89662…83bc25b` | 6CADA367FB1C100088120EA202D568 |
+| EM OV TLS CA - G3C | TLS | `cb6e1516…bf9c7c3f` | 296926C227A3A1526392B19482A504 |
+| EM OV CS CA - G3B | Code signing | `9e39de28…b067b4` | 7818933F8F85B4619A2B35FBA83D0A |
+| EM OV CS CA - G3C | Code signing | `4b2460a4…630b1` | 544B7F922C31AE220A4A922916F6E6 |
+
+Roots: `emSign Root TLS CA - G3` (`7dd78d5f…2746ed8d`), `emSign Root CS CA - G3`
+(`f2edaaff…aba34a5`). Full machine-readable list in [`indicators.csv`](indicators.csv),
+PEMs in [`certs/`](certs/).
+
+## Install
+
+Requires Python 3.10+ and `openssl` on PATH for distrust fingerprint checks.
+
+```bash
+pip install -e .
+emsign-g3 scan
+emsign-g3 export-indicators --verify
+```
+
+Override data paths when needed: `EMSIGN_G3_INDICATORS_CSV`, `EMSIGN_G3_CERTS_DIR`.
+
+Legacy entry points (`python3 tools/…`) remain as thin shims and work without install.
+
+## Tools
+
+- **`emsign-g3`** (CLI) — `scan`, `distrust`, `export-indicators` subcommands (see below).
+- **`tools/emsign_trust_scanner.py`** — shim for `emsign-g3 scan`.
+- **`tools/emsign_distrust.py`** — shim for `emsign-g3 distrust`.
+- **`tools/emsign-g3-distrust.rules`** — Suricata/Snort rules that drop TLS whose leaf
+  is issued by any of the eight (matches `tls.cert_issuer`). Deploy inline or behind a
+  decrypting proxy. Verified to fire on Suricata 8.
+- **`tools/suricata_livefire_test.sh`** — replays a recorded real-world handshake
+  (`tests/fixtures/`) through the rules and checks they fire. No root, no network.
+- **`tools/record_handshake_fixture.py`** — how that fixture was recorded: a TLS 1.2
+  handshake with a public researcher demo host, captured without root.
+- **`src/emsign_g3/`** — installable package; loads [`indicators.csv`](indicators.csv) via
+  `emsign_g3.indicators`.
+- **`tools/export_siem_indicators.py`** — shim for `emsign-g3 export-indicators`.
+
+## Operator playbook
+
+### Network detection (Suricata)
+
+1. Ship `tools/emsign-g3-distrust.rules` to your Suricata sensor (inline IPS or tap IDS).
+2. For passive IDS, change rule actions from `drop` to `alert` in the rules file.
+3. Validate offline before deploy:
+
+   ```bash
+   tools/suricata_livefire_test.sh
+   ```
+
+   Expect `PASS` and sid `92083401` on the recorded DV G3B fixture. Suricata must parse
+   TLS (`tls_events` > 0 in the script output).
+
+4. Correlate production alerts on `signature` containing `Bug2083449` or sid
+   `92083401`–`92083408` (see [`indicators.csv`](indicators.csv) `suricata_sid` column).
+
+### Host hardening (trust stores)
+
+1. Inventory (read-only):
+
+   ```bash
+   emsign-g3 scan
+   emsign-g3 scan --json   # MDM / fleet collection
+   ```
+
+2. Plan explicit distrust of the **eight intermediates** (dry-run first):
+
+   ```bash
+   emsign-g3 distrust
+   sudo emsign-g3 distrust --apply
+   ```
+
+   PEMs load from `certs/` by default; fingerprints are checked against `indicators.csv`.
+
+3. Roll back with `emsign-g3 distrust --undo` (add `--apply` to execute).
+
+### SIEM / SOAR indicators
+
+- **Canonical table:** [`indicators.csv`](indicators.csv) — eight compromised intermediates,
+  three related trust anchors, SHA-256 fingerprints, serials, Suricata SIDs, and
+  `tls.cert_issuer` match strings.
+- **Bulk export:**
+
+  ```bash
+  emsign-g3 export-indicators
+  emsign-g3 export-indicators --ndjson
+  emsign-g3 export-indicators --verify   # PEMs vs CSV
+  emsign-g3 export-indicators --format sigma --output-dir rules/sigma/
+  emsign-g3 export-indicators --format elastic-kql --output-dir rules/elastic/
+  emsign-g3 export-indicators --check-committed-rules
+  ```
+
+  Committed copies live under [`rules/sigma/`](rules/sigma/) and [`rules/elastic/`](rules/elastic/)
+  (regenerate with [`tools/regenerate_detection_rules.sh`](tools/regenerate_detection_rules.sh)).
+
+  Use host fields (`sha256_fingerprint`) against scanner/MDM output; use network fields
+  (`suricata.sid`, `tls_cert_issuer_match`) against Suricata `eve.json`.
+
+  **Sigma** and **Elastic KQL** exports are starter detections mapped to Suricata EVE
+  (`tls.issuerdn`, `alert.signature_id`). Tune field names before production alerting.
+
+## Releases
+
+Tagged releases (`v*`) build wheels, attach indicator bundles and rule tarballs, and
+publish to PyPI when trusted publishing is configured. See [`RELEASE.md`](RELEASE.md).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+ruff check src tests
+emsign-g3 export-indicators --verify
+emsign-g3 export-indicators --check-committed-rules
+tools/suricata_livefire_test.sh   # optional; requires Suricata
+```
+
+Keep [`indicators.csv`](indicators.csv) in sync with
+[`src/emsign_g3/data/indicators.csv`](src/emsign_g3/data/indicators.csv) (enforced by tests).
+
+## The durable fix
+
+Trust-store distrust reaches browsers via OneCRL / CRLSet and OS CA updates. The long
+tail — non-browser TLS clients, embedded devices, Java/Node/`certifi` bundles, code
+signing — updates on its own schedule. Use the scanner to find exposed clients and the
+distruster/IDS rules to deny the keys until every client has dropped the roots.

emsign_g3_distrust-0.2.0/pyproject.toml

@@ -0,0 +1,54 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "emsign-g3-distrust"
+version = "0.2.0"
+description = "Detect and deny compromised eMudhra/emSign G3 intermediate CAs (Mozilla Bug 2083449)"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "jacobyoby" }]
+keywords = ["security", "tls", "pki", "suricata", "emudhra"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security :: Cryptography",
+    "Topic :: System :: Systems Administration",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "ruff>=0.4"]
+
+[project.scripts]
+emsign-g3 = "emsign_g3.cli:main"
+
+[project.urls]
+Repository = "https://github.com/jacobyoby/emsign-g3-distrust"
+"Mozilla Bug" = "https://bugzilla.mozilla.org/show_bug.cgi?id=2083449"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+emsign_g3 = ["data/indicators.csv", "data/certs/*.pem"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 100
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP"]

emsign_g3_distrust-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

emsign_g3_distrust-0.2.0/src/emsign_g3/__init__.py

@@ -0,0 +1,3 @@
+"""Defensive tooling for eMudhra/emSign G3 CA distrust (Mozilla Bug 2083449)."""
+
+__version__ = "0.2.0"

emsign_g3_distrust-0.2.0/src/emsign_g3/cli.py

@@ -0,0 +1,79 @@
+"""Unified CLI for emsign-g3 distrust tooling."""
+from __future__ import annotations
+
+import argparse
+
+from emsign_g3.distrust import run_distrust
+from emsign_g3.export import run_export
+from emsign_g3.paths import default_certs_dir, indicators_csv_path
+from emsign_g3.scan import run_scan
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="emsign-g3",
+        description="Detect and deny compromised eMudhra/emSign G3 intermediates (Bug 2083449).",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan_p = sub.add_parser("scan", help="inventory trust stores (read-only)")
+    scan_p.add_argument("--json", action="store_true", help="machine-readable output")
+
+    dist_p = sub.add_parser("distrust", help="plan or apply intermediate blocklist")
+    dist_p.add_argument("--apply", action="store_true", help="execute (default: dry run)")
+    dist_p.add_argument("--undo", action="store_true", help="roll back instead of distrust")
+    dist_p.add_argument(
+        "--certs-dir",
+        default=None,
+        help=f"directory with eight verified PEMs (default: {default_certs_dir()})",
+    )
+
+    exp_p = sub.add_parser("export-indicators", help="SIEM/SOAR indicator bundle")
+    exp_p.add_argument("--csv", default=None, help="path to indicators.csv")
+    exp_p.add_argument(
+        "--format",
+        choices=("json", "ndjson", "sigma", "elastic-kql"),
+        default="json",
+        help="output format (default: json)",
+    )
+    exp_p.add_argument(
+        "--ndjson",
+        action="store_true",
+        help="shorthand for --format ndjson (deprecated)",
+    )
+    exp_p.add_argument("--verify", action="store_true", help="verify PEMs match CSV")
+    exp_p.add_argument("--certs-dir", default=None, help="PEM directory for --verify")
+    exp_p.add_argument(
+        "--output-dir",
+        default=None,
+        help="write --format sigma or elastic-kql files to this directory",
+    )
+    exp_p.add_argument(
+        "--check-committed-rules",
+        action="store_true",
+        help="verify rules/sigma and rules/elastic match generators",
+    )
+
+    args = parser.parse_args(argv)
+
+    if args.command == "scan":
+        return run_scan(as_json=args.json)
+    if args.command == "distrust":
+        return run_distrust(apply=args.apply, undo=args.undo, certs_dir=args.certs_dir)
+    if args.command == "export-indicators":
+        return run_export(
+            csv_path=args.csv or indicators_csv_path(),
+            fmt=args.format,
+            ndjson=args.ndjson,
+            verify=args.verify,
+            certs_dir=args.certs_dir,
+            output_dir=args.output_dir,
+            check_committed_rules=args.check_committed_rules,
+        )
+
+    parser.error(f"unknown command: {args.command}")
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMDVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAKSu5njyM2K0wORgt3LyFDAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTU1
+NDA4WhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAE557ZwEqXc8RzXlERHahawr1eZKs3S4DhLLwgOOweTw47gS/J
+hZ4eZ6+wTi+LyX90hbplqpEe6KTkW2LVzAPVa+Z4s8OMtNyTfKJGDiOEU8iSk10p
+1E+R4VYGtjzO2rRoo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFOIeL+ccGTkOVUtiwSAkVzUkiiUUMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYi5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQi5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwLmsGXi6oFMJ2klkcEMXMug6gvxQWZWkewiDWVzQyl2L6z6DuQfPO
+Ibh1grvdULDCAjEAxZvLlxUavG69J6wnSjC8XBbqNIQsJ6CE2QdNOe84Ptxb6VG8
+gt2TlfJbHii+KNvK
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMDVTLSCAG3C.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIPWIsuPCu4zaE+GhIJJUMhMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNTM1
+MDlaFw00MDA0MjgxODMwMDBaMEAxCzAJBgNVBAYTAlVTMRQwEgYDVQQKDAtlTXVk
+aHJhIEluYzEbMBkGA1UEAwwSRU0gRFYgVExTIENBIC0gRzNDMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEOnp4YsjETTJN3WkDOmeCwO/u/kBV5ooSP6A3G6O9kZRRTuFy
+pDPjYw8CvRiAN9nlFJ+bd9uUooHfmHsv6oiLdL3+j9pMEJnubKGVZv4+8OX2sJpV
+bMyLpQVh3xsqRB0Bo4IBljCCAZIwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFK5+EFw8KZbBqEcnBVnx4D3U5QrzMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBdBgNVHSAEVjBUMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAmQwCAYGZ4EMAQIBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRFZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIxAMEN2HWMocbuWdy1d33pH6JpMvP/V/DIS5PtZbv1Q7TXEbxrcyxg
+yuddOJscYDJJlAIwB4sH1BpbScDzkdD4tJBSwrG/1Mx82vb8YaySehNuu1+1oXNd
+AEKwaJ0mVzScy2+6
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMEVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu2gAwIBAgIQAMfEHv6S2CXwXq6EGkqCwTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTYw
+MzMxWhcNNDAwNDI4MTgzMDAwWjA/MQswCQYDVQQGEwJOTDETMBEGA1UECgwKZU11
+ZGhyYSBCVjEbMBkGA1UEAwwSRU0gRVYgVExTIENBIC0gRzNCMHYwEAYHKoZIzj0C
+AQYFK4EEACIDYgAEJduoWmTTl9oLEFLp6lRuSHvv6pydnWigxerc/u91ppu11vwB
+9Cv7ym60C81kwHZ+Nv/QXZeoE8WqDGyVMOec9fCGZGjxOAZCCqXIUYQLHiUlQOeQ
+5LZUw4Uu1krx6GV9o4IBlTCCAZEwHwYDVR0jBBgwFoAU4TqrIXzx401UrtRyt/2L
+WUIgkFQwHQYDVR0OBBYEFD7cINmJRpiHe4c/2IFHslwV2EcGMB0GA1UdJQQWMBQG
+CCsGAQUFBwMBBggrBgEFBQcDAjBcBgNVHSAEVTBTMDkGCysGAQQBg44hAQABMCow
+KAYIKwYBBQUHAgEWHGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDQYLKwYB
+BAGDjiEBAngwBwYFZ4EMAQEwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1FVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNpADBmAjEA9Jq999oaOUKhFwopw33iCmt0OHIn3gjT43GfuOHR/YckXdwoNdDA
+lIEhz0NgRO3/AjEAvY/a3OMvktIZLYjn+WLKmp0QhrIMV+e6EpS7j4GVeOKouNp6
+MN/P+ByGeiRMghzB
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMEVTLSCAG3C.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDaDCCAu6gAwIBAgIQAIAJkopkEHYBrwX6LxnxCTAKBggqhkjOPQQDAzBWMQsw
+CQYDVQQGEwJJTjElMCMGA1UECgwcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRl
+ZDEgMB4GA1UEAwwXZW1TaWduIFJvb3QgVExTIENBIC0gRzMwHhcNMjUwNDMwMTUz
+OTMxWhcNNDAwNDI4MTgzMDAwWjBAMQswCQYDVQQGEwJVUzEUMBIGA1UECgwLZU11
+ZGhyYSBJbmMxGzAZBgNVBAMMEkVNIEVWIFRMUyBDQSAtIEczQzB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABC1W6Cmm+4LGSkaX2WCvlR6QZ66R+SbTQwbaSKiq63hptqZ+
+bSdCbgRCqgOzbhmI3/Y2UU7hzwf1uks/8qBmRa59MdWGatMao9JG6wsxd+6Zy3Vm
+xRbOdICKZo+R8MR/yqOCAZUwggGRMB8GA1UdIwQYMBaAFOE6qyF88eNNVK7Ucrf9
+i1lCIJBUMB0GA1UdDgQWBBSmJV6AqU2385Z8G8eR35K87kvrXzAdBgNVHSUEFjAU
+BggrBgEFBQcDAQYIKwYBBQUHAwIwXAYDVR0gBFUwUzA5BgsrBgEEAYOOIQEAATAq
+MCgGCCsGAQUFBwIBFhxodHRwOi8vcmVwb3NpdG9yeS5lbXNpZ24uY29tMA0GCysG
+AQQBg44hAQJ4MAcGBWeBDAEBMHUGCCsGAQUFBwEBBGkwZzAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AtYy5lbXNpZ24uY29tMD8GCCsGAQUFBzAChjNodHRwOi8vcmVw
+b3NpdG9yeS5lbXNpZ24uY29tL2NlcnRzL0VNRVZUTFNDQUczQy5wN2MwNwYDVR0f
+BDAwLjAsoCqgKIYmaHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290dGxzY2FnMy5j
+cmwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwCgYIKoZIzj0E
+AwMDaAAwZQIwBy1wTnzH4lXDTy2PD91ysLjvnlVN3JbJmc1BIMEU8TOLkYVHibMc
+9HeyonikFSfmAjEA6uE3QRxlrZTz/1/lXPTEMUhoauAtycagtlNFp79kjhvNa2/f
+Aal1GNxsOutLnr0Y
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMOVCSCAG3B.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuCgAwIBAgIPeBiTP4+FtGGaKzX7qD0KMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2MDgy
+N1oXDTQwMDQyODE4MzAwMFowPjELMAkGA1UEBhMCTkwxEzARBgNVBAoMCmVNdWRo
+cmEgQlYxGjAYBgNVBAMMEUVNIE9WIENTIENBIC0gRzNCMHYwEAYHKoZIzj0CAQYF
+K4EEACIDYgAEqrsPsGZqz88B+tUr/P1MK/LLPDSX3nOVDlgZth/mlQmHQcjEkUOb
+NKBDHK/+W/m0wcjorgAB+fTcitgsWfNjnpbNbD1NsM7+wmw9YlF7N3YTcnQ/jord
+d7EAZPKr5eBQo4IBizCCAYcwHwYDVR0jBBgwFoAUaHQD+IXKjVRQVx0W4MjeRQ2r
+zS0wHQYDVR0OBBYEFHn66OzP2w11jaRY1p+27dx8Sd7mMBMGA1UdJQQMMAoGCCsG
+AQUFBwMDMF4GA1UdIARXMFUwOQYLKwYBBAGDjiEBAAEwKjAoBggrBgEFBQcCARYc
+aHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTAOBgwrBgEEAYOOIQECgUgwCAYG
+Z4EMAQQBMHQGCCsGAQUFBwEBBGgwZjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3At
+Yi5lbXNpZ24uY29tMD4GCCsGAQUFBzAChjJodHRwOi8vcmVwb3NpdG9yeS5lbXNp
+Z24uY29tL2NlcnRzL0VNT1ZDU0NBRzNCLnA3YzA2BgNVHR8ELzAtMCugKaAnhiVo
+dHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3Rjc2NhZzMuY3JsMA4GA1UdDwEB/wQE
+AwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMAoGCCqGSM49BAMDA2kAMGYCMQC/zr03
+YEELsNKqzUtH2dVFi4BaKFdyrr/6G1dIWp8KAVgsw2/u4lyyboUDaC9jDvICMQC9
+HTxku84tNX9dmHOtH7aC2Nu/JM0jTf6KjZAvovCJzzv1IFWSZpVLZibynMLXOrM=
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMOVCSCAG3C.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAuGgAwIBAgIPVEt/kiwxriIKSpIpFvbmMAoGCCqGSM49BAMDMFUxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MR8wHQYDVQQDDBZlbVNpZ24gUm9vdCBDUyBDQSAtIEczMB4XDTI1MDQzMDE2Mzg0
+MFoXDTQwMDQyODE4MzAwMFowPzELMAkGA1UEBhMCVVMxFDASBgNVBAoMC2VNdWRo
+cmEgSW5jMRowGAYDVQQDDBFFTSBPViBDUyBDQSAtIEczQzB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABLnw4GNHAqacpqrdRDz9YsQbm6SyCSRpfXl052kaEm+5avs+NML9
+O8X0gwYfJl3CpYQ2NHMjUQQ2so8E84YjYwZ5gOJQPgJTLWVGI1pxZaJZoe9Jb3Qb
+X97neHII5Lj676OCAYswggGHMB8GA1UdIwQYMBaAFGh0A/iFyo1UUFcdFuDI3kUN
+q80tMB0GA1UdDgQWBBTub3MpjW+/p7Mbw5U09hVWRHhmtzATBgNVHSUEDDAKBggr
+BgEFBQcDAzBeBgNVHSAEVzBVMDkGCysGAQQBg44hAQABMCowKAYIKwYBBQUHAgEW
+HGh0dHA6Ly9yZXBvc2l0b3J5LmVtc2lnbi5jb20wDgYMKwYBBAGDjiEBAoFIMAgG
+BmeBDAEEATB0BggrBgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw
+LWMuZW1zaWduLmNvbTA+BggrBgEFBQcwAoYyaHR0cDovL3JlcG9zaXRvcnkuZW1z
+aWduLmNvbS9jZXJ0cy9FTU9WQ1NDQUczQy5wN2MwNgYDVR0fBC8wLTAroCmgJ4Yl
+aHR0cDovL2NybC5lbXNpZ24uY29tLz9yb290Y3NjYWczLmNybDAOBgNVHQ8BAf8E
+BAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQDAwNoADBlAjEA8yPg
+8sntOhLwV2QXJ5LEaKSpo/fnE3uOgTadK73fDhyjiqr0Io9GVuQTYqBPbQ2TAjBg
+euApmBS486+iei03lRrp139dPw6k28jjGNvWsAU7A1N86J1zPJVDEyVH+nMAWC0=
+-----END CERTIFICATE-----

emsign_g3_distrust-0.2.0/src/emsign_g3/data/certs/EMOVTLSCAG3B.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZjCCAu2gAwIBAgIPbK2jZ/scEACIEg6iAtVoMAoGCCqGSM49BAMDMFYxCzAJ
+BgNVBAYTAklOMSUwIwYDVQQKDBxlTXVkaHJhIFRlY2hub2xvZ2llcyBMaW1pdGVk
+MSAwHgYDVQQDDBdlbVNpZ24gUm9vdCBUTFMgQ0EgLSBHMzAeFw0yNTA0MzAxNjAw
+MTJaFw00MDA0MjgxODMwMDBaMD8xCzAJBgNVBAYTAk5MMRMwEQYDVQQKDAplTXVk
+aHJhIEJWMRswGQYDVQQDDBJFTSBPViBUTFMgQ0EgLSBHM0IwdjAQBgcqhkjOPQIB
+BgUrgQQAIgNiAARziXqg6zz9yosSQC/68KvE4SErr43ud4rJ7i1tuD+sKAxeBWOK
+56Ks1xwyKo42HN659pxDArndjXPRzGyqsswK7k4hbOl53VGKSvS2JuVoTN1lgDft
+DIVOTMEvTPhkbQ2jggGWMIIBkjAfBgNVHSMEGDAWgBThOqshfPHjTVSu1HK3/YtZ
+QiCQVDAdBgNVHQ4EFgQUm9hlUa/n5yw3rQjuaRnZvzeErgowHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMF0GA1UdIARWMFQwOQYLKwYBBAGDjiEBAAEwKjAo
+BggrBgEFBQcCARYcaHR0cDovL3JlcG9zaXRvcnkuZW1zaWduLmNvbTANBgsrBgEE
+AYOOIQECbjAIBgZngQwBAgIwdQYIKwYBBQUHAQEEaTBnMCQGCCsGAQUFBzABhhho
+dHRwOi8vb2NzcC1iLmVtc2lnbi5jb20wPwYIKwYBBQUHMAKGM2h0dHA6Ly9yZXBv
+c2l0b3J5LmVtc2lnbi5jb20vY2VydHMvRU1PVlRMU0NBRzNCLnA3YzA3BgNVHR8E
+MDAuMCygKqAohiZodHRwOi8vY3JsLmVtc2lnbi5jb20vP3Jvb3R0bHNjYWczLmNy
+bDAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADAKBggqhkjOPQQD
+AwNnADBkAjBAk+5BizdJhrED3wb7F2Gm7bWI60dlNd075nghT2TrR4NWKZtJZcbc
+28xxIY/NONICMF6mPdsjosaqmvEMWqKcBh4vsIvXSKnQj5o8zrFB4oKS+accjYTe
+8Dz3bQjauvy9uw==
+-----END CERTIFICATE-----