[UlisesGascon]

Mozilla keeps emSign Root CA - G1, Izenpe.com and Firmaprofesional CIF A62634068 in its root store but distrusts TLS server certificates they issued after 2026-11-16, 2026-04-15 and 2026-08-06 respectively (CKA_NSS_SERVER_DISTRUST_AFTER). tools/mk-ca-bundle.pl does not carry that attribute into node_root_certs.h, so Node.js keeps accepting new certificates from these roots that browsers reject.

This adds a distrust-after table next to the SPKI blocklist from #66871, checked from the same verify callback on every SSL_CTX. When a client verifies a server chain through a listed key and the leaf's notBefore is after the cutoff, the chain fails with CERT_REVOKED; certificates issued up to the cutoff keep working. The table is keyed by public key, so a cross-signed copy of the root is caught as well.

Client certificates are not affected. The attribute is Mozilla's server authentication policy, the roots stay trusted anchors otherwise, and these CAs are large issuers of personal certificates. This is the scope the 2016 StartCom/WoSign cutoff had (89217d1).

The test uses a fixture CA that is a permanent entry on the list with a 2019 cutoff, with leaves issued exactly at the cutoff and one second after it, so nothing depends on the clock. Its key is pinned in the fixtures Makefile like blocked-ca-key.pem.

Known limitation

Node.js has no Certificate Transparency checking, so a backdated notBefore is not detected. Same as the 2016 cutoff.

Points for reviewers

• The dates are hand-maintained in crypto_context.cc for now. A follow-up PR generates them from certdata.txt on every root certificate update. Once tools: generate distrust-after dates from certdata.txt #67414 land that step will be automated.
• tools: update mk-ca-bundle to 1.35 #67403 adds a fingerprint exclude list to mk-ca-bundle.pl. The two are complementary: that one removes a root outright, this one keeps existing certificates working until they expire.

---

Notable change

Node.js now honours Mozilla's distrust-after dates for roots in the bundled store. TLS server certificates issued by emSign Root CA - G1 after 2026-11-16, by Izenpe.com after 2026-04-15, or by Firmaprofesional CIF A62634068 after 2026-08-06 are rejected with CERT_REVOKED, matching Firefox. Certificates issued before those dates keep working until they expire, and client certificates are not affected.

Contributed by Ulises Gascón in #67412.

---

Context

• Fixes: Remove or date-limit emSign Root CA - G1 before Mozilla's 2026-11-16 cutoff #67391
• Refs: https://bugzilla.mozilla.org/show_bug.cgi?id=2089115
• Refs: tools: update mk-ca-bundle to 1.35 #67403
• Complementary to tools: update mk-ca-bundle to 1.35 #67403
• Assisted-by: Claude, Codex, Mistral

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[github-actions]

The notable-change PRs with changes that should be highlighted in changelogs. label has been added by @UlisesGascon.

Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section.