Update Orbit CA certs (Mozilla root store sync) for fleetd v1.59.0

[lucasmrod]

Summary

Track the automated Orbit CA certificate bundle update in #49160, which syncs orbit/pkg/packaging/certs.pem to the latest Mozilla root store so fleetd ships in v1.59.0 with an up-to-date set of trusted CAs.

Details

• Source: automated update-certs.yml GitHub Action (PR Update Orbit CA certs [automated] #49160)
• Mozilla snapshot: Jan 5 2026 → Jul 10 2026
• mk-ca-bundle.pl: v1.30 → v1.33
• Net change: 1 CA added, 24 CAs removed (144 → 121 roots)

Added (1)

• e-Szigno TLS Root CA 2023

Removed (24)

• Trustwave (exiting CA business): Trustwave Global CA, Trustwave Global ECC P256, Trustwave Global ECC P384, SecureTrust CA, Secure Global CA
• Entrust distrust (incl. Entrust-owned AffirmTrust): Entrust Root CA – G2, Entrust Root CA – EC1, AffirmTrust Commercial, AffirmTrust Networking, AffirmTrust Premium, AffirmTrust Premium ECC
• Legacy DigiCert / QuoVadis roots: DigiCert Assured ID Root CA, DigiCert Global Root CA, DigiCert High Assurance EV Root CA, QuoVadis Root CA 2, QuoVadis Root CA 3
• Compliance distrust: GLOBALTRUST 2020
• Other retirements: COMODO Certification Authority, SwissSign Gold CA – G2, TeliaSonera Root CA v1, Certigna, certSIGN ROOT CA, FIRMAPROFESIONAL CA ROOT-A WEB, GTS Root R2

Acceptance criteria

• Update Orbit CA certs [automated] #49160 is reviewed and merged
• Updated CA bundle ships in fleetd v1.59.0

References

• PR: Update Orbit CA certs [automated] #49160

[xpkoala]

Validation: #49161 — Update Orbit CA certs (Mozilla root store sync) for fleetd v1.59.0

Verdict: ✅ PASS. Bundle is byte-identical to upstream, correctly embedded, installs correctly, and is enforced by osquery at runtime — accepting a real Fleet server and rejecting untrusted chains. Two notes below.

Validated on rc-minor-fleetd-v1.59.0 @ df36ce891a (== remote RC head).

Acceptance criteria

AC	Result
#49160 reviewed and merged	✅ Merged 2026-07-10, APPROVED (lucasmrod), merge commit 11df098d7c
Updated CA bundle ships in fleetd v1.59.0	✅ Ancestor of the RC branch; present in built installers; enforced by osquery at runtime

Static + packaging

#	Check	Result
1	Issue's documented diff for #49160	✅ 144 → 121 roots; Jan 5 → Jul 10 2026; mk-ca-bundle 1.30 → 1.33; 1 added (e-Szigno TLS Root CA 2023); all 24 named removals confirmed, none extra
2	Bundle vs upstream (repo's own CI invariant)	✅ diff vs curl.se/ca/cacert.pem (ignoring the "as of" line) → identical; same certdata SHA256 e5791280…, 119 roots, mk-ca-bundle 1.33
3	Bundle hygiene	✅ 119/119 parse; 0 expired, 0 expiring within 12 months; all load into a Go x509.CertPool
4	go:embed wiring	✅ embedded OsqueryCerts sha256 68806177960abd10… == on-disk file
5	Built macOS .pkg + Linux .deb from RC branch	✅ /opt/orbit/certs.pem byte-identical in both payloads; 119 roots; e-Szigno present, removals absent
6	dpkg -i in clean ubuntu:24.04 arm64 container	✅ installs clean; on-disk bundle sha256 matches repo
7	No trust regression, 13 endpoints, old vs new bundle	✅ identical, all OK — fleetqa, dogfood, fleetdm.com, updates.fleetdm.com, tuf.fleetctl.com, mdmenrollment.apple.com, manage.microsoft.com, login.microsoftonline.com, digicert, aws, cloudflare, google, letsencrypt
8	Changelog staged	✅ orbit/changes/updated-ca-certs present and correctly unconsumed — rc-minor-fleetd-v1.58.0 was cut before these commits (still has the 144-cert Jan 5 bundle), so 1.59.0 is genuinely first to carry it

Runtime — osquery trust behavior (4 cases)

Case	Server	Trust store	Result
Full e2e enrollment	fleetqa.ngrok.io → localhost:8080 (ngrok TLS, ISRG Root X1)	shipped bundle, 119 roots	✅ enrolled and reporting — node_key issued, /config accepted (config_hash f80dee82…, config_valid: 1), /distributed/read returned detail + label queries, /distributed/write submitted full results (software inventory, system_info, users, labels, policies) across 2 cycles. 0 TLS errors. Host fbcbb88369c6 / uuid a5eb215d-78ba-4f9d-8377-2563477ef208 live in Fleet
Reject — root removed	fleetqa.ngrok.io	bundle minus the 2 ISRG roots (117)	✅ Request error: certificate verify failed
Reject — untrusted	localhost:8080 direct, self-signed CN=Fleet Test	shipped bundle	✅ Request error: certificate verify failed (correct — self-signed isn't in the Mozilla store)
Control — pinned cert	localhost:8080, --fleet-certificate	pinned fleet.pem (bundle bypassed)	✅ enrolled; confirms the pinned-cert path never consults certs.pem

Row 1 is the definitive test: a real fleetd install completed enrollment and host-detail reporting with the new 119-root bundle as its sole trust anchor. Rows 2–3 confirm it fails closed with no silent system-store fallback — so row 1's success is attributable to the bundle, not a fallback.