Closed JamesTheAwesomeDude closed 2 years ago
According to censys, this CA actually does have validation paths back to the Federal Common Policy CA — what is unique is that Mozilla doesn't recognize these (of course, this is only a consequence of Mozilla's not recognizing the federal common policy CA anyway)
Closing this since the key actually is under the federal common policy CA in the trust tree; no need to add it separately
DoD Root CA 3
This one, bizarrely (and, seemingly, uniquely among the DoD root certs), does not have any cross-signature path grounding it the Federal Common Policy CA.
Though it shares a
Subject
, as well as the actual public key itself, with this certificate (which has been cross-signed, though expires much sooner).My guess is they just screwed something up during the renewal process, and whatever they did changed the fingerprint. [idle-interest-TODO: what did change?]