Block the Qaznet Trust Network Root Cert
As announced at
https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html
Bug: 996164
Change-Id: Ibf0712105d6f86b283f73a15c7e45f4fecceb4ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1763229
Reviewed-by: David Benjamin <davidben@chromium.org>
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#689032}
diff --git a/net/cert/cert_verify_proc_blocklist.inc b/net/cert/cert_verify_proc_blocklist.inc
index 3d3b2c5..0df8aaa 100644
--- a/net/cert/cert_verify_proc_blocklist.inc
+++ b/net/cert/cert_verify_proc_blocklist.inc
@@ -211,6 +211,10 @@
{0xb4, 0xd5, 0xc9, 0x20, 0x41, 0x5e, 0xd0, 0xcc, 0x4f, 0x5d, 0xbc,
0x7f, 0x54, 0x26, 0x36, 0x76, 0x2e, 0x80, 0xda, 0x66, 0x25, 0xf3,
0x3f, 0x2b, 0x6a, 0xd6, 0xdb, 0x68, 0xbd, 0xba, 0xb2, 0x9a},
+ // 00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem
+ {0xb5, 0xba, 0x8d, 0xd7, 0xf8, 0x95, 0x64, 0xc2, 0x88, 0x9d, 0x3d,
+ 0x64, 0x53, 0xc8, 0x49, 0x98, 0xc7, 0x78, 0x24, 0x91, 0x9b, 0x64,
+ 0xea, 0x08, 0x35, 0xaa, 0x62, 0x98, 0x65, 0x91, 0xbe, 0x50},
// d8888f4a84f74c974dffb573a1bf5bbbacd1713b905096f8eb015062bf396c4d.pem
{0xc0, 0xed, 0x20, 0x53, 0x46, 0xbb, 0xbd, 0xe0, 0x6e, 0xb5, 0x60,
0xf5, 0xce, 0xe0, 0x2a, 0x36, 0x34, 0xe2, 0x47, 0x4a, 0x7e, 0x76,
diff --git a/net/data/ssl/blocklist/00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem b/net/data/ssl/blocklist/00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem
new file mode 100644
index 0000000..b15764c3
--- /dev/null
+++ b/net/data/ssl/blocklist/00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem
@@ -0,0 +1,122 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number:
+ 3d:95:7f:ca:1f:8c:0f:c8:69:2c:01:99:4e:b5:52:31:03:5b:9d:f1
+ Signature Algorithm: sha256WithRSAEncryption
+ Issuer: C = KZ, CN = Qaznet Trust Network
+ Validity
+ Not Before: Feb 2 05:41:00 2016 GMT
+ Not After : Feb 2 05:41:00 2046 GMT
+ Subject: C = KZ, CN = Qaznet Trust Network
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ RSA Public-Key: (4096 bit)
+ Modulus:
+ 00:ee:1d:b5:50:e8:ab:22:5a:4d:7f:74:20:47:28:
+ 93:52:74:4a:aa:b0:78:32:05:53:be:cf:c6:ab:ad:
+ 80:42:a0:fc:b0:17:b1:dc:af:9a:d8:59:86:ef:bc:
+ 56:5d:48:5b:bd:ce:0c:01:9f:dd:9d:7d:28:ce:26:
+ 7e:ee:25:7b:89:0a:78:b4:db:88:88:cc:40:3b:d4:
+ 51:d8:df:00:00:0c:99:b8:73:7e:27:b8:dc:0e:36:
+ 2c:1e:fa:97:44:bc:5e:a4:ae:3b:18:33:23:0d:3c:
+ 03:7d:bd:fb:a5:73:60:54:d8:64:9b:77:78:71:98:
+ 11:8e:54:97:58:f6:c5:57:a1:70:78:e7:66:c5:63:
+ 88:aa:1b:ac:e1:e4:df:ee:52:a0:22:38:54:33:08:
+ 83:b3:f1:b3:f5:d9:d3:4e:48:06:ea:23:a1:ef:ca:
+ 80:98:54:34:22:ac:40:01:9a:87:32:df:ab:11:cd:
+ 5a:5c:81:c2:fc:fd:8c:af:02:f4:cc:2a:fe:91:11:
+ 2f:d1:b5:1b:4f:01:c0:1e:5b:7e:77:2d:fe:f8:87:
+ 04:ed:bf:35:87:2e:90:69:b5:19:06:8e:c0:a7:15:
+ 1d:a6:e1:9c:ac:6b:11:3e:f5:a1:20:c5:93:36:3e:
+ c5:13:a6:81:14:43:c0:8d:5a:b8:5c:f7:0e:09:f4:
+ 88:04:7f:40:d9:fc:a3:e4:f3:2e:78:cb:65:0b:30:
+ fa:15:24:a4:6d:5b:b4:85:d8:72:ae:76:40:7b:46:
+ f4:92:70:4b:13:9f:04:3a:f0:cf:3f:cf:0e:5a:83:
+ 6c:3e:cf:96:ca:46:40:42:8d:c5:5f:57:dd:53:7e:
+ 1d:a7:36:93:13:1f:86:a0:ca:99:f1:c6:f7:6d:56:
+ ce:f8:d5:08:be:11:a7:bc:6e:bf:26:6a:10:21:88:
+ e2:46:7b:e3:fc:ef:2a:a8:a8:26:da:08:e6:00:37:
+ e5:8a:eb:8d:f0:b0:4e:97:6c:8d:59:ea:8b:8e:c6:
+ 00:33:d9:ab:f7:13:85:b3:c9:70:3c:20:97:a5:6f:
+ ec:5a:a8:d5:b3:69:84:a1:e5:72:6c:60:62:d0:c2:
+ 32:7e:fd:dc:a8:88:a5:88:41:82:23:86:91:3f:4f:
+ 8f:9b:55:48:e8:95:68:6c:31:5b:c0:08:2f:ac:59:
+ e2:52:e4:b1:98:31:55:51:c5:a8:33:e8:c4:14:de:
+ e4:6d:e9:2e:12:29:d8:0f:13:84:41:54:ac:e5:62:
+ b8:5b:8b:71:0c:6a:6e:74:6c:e6:ae:40:71:95:70:
+ 5a:5a:a7:ee:a8:6e:ee:d3:f3:ee:dc:9a:ba:6b:4b:
+ fc:4e:3c:d5:44:98:13:70:69:48:d2:f3:54:50:87:
+ c9:e7:a7
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Basic Constraints: critical
+ CA:TRUE
+ X509v3 Subject Key Identifier:
+ F4:94:BF:DE:50:B6:DB:6B:24:3D:9E:F7:BE:3A:AE:36:D7:FB:0E:05
+ X509v3 Authority Key Identifier:
+ keyid:F4:94:BF:DE:50:B6:DB:6B:24:3D:9E:F7:BE:3A:AE:36:D7:FB:0E:05
+
+ X509v3 Key Usage: critical
+ Non Repudiation, Certificate Sign, CRL Sign
+ Signature Algorithm: sha256WithRSAEncryption
+ b1:85:13:88:2d:2d:cc:ac:90:79:42:a1:24:ff:97:9e:16:d9:
+ db:86:fa:73:fd:c3:a7:b4:29:71:9c:3f:b4:01:80:ec:71:98:
+ 9e:4f:ba:a7:f5:f5:d8:c9:14:b3:8d:9f:19:99:f1:46:45:44:
+ 08:2c:f7:a9:45:eb:8d:2d:ed:c0:01:a7:06:8b:38:96:6f:95:
+ eb:f3:31:2c:26:b2:d0:3c:b5:f5:b3:43:df:94:19:87:eb:9d:
+ 56:be:3a:11:2a:4e:9f:a5:4e:0b:46:3d:2b:4f:39:b5:11:42:
+ 5a:d3:73:e8:8d:f3:09:48:12:75:ec:f7:4a:c9:f7:dd:1b:01:
+ 24:8c:8f:4b:64:6c:70:18:ff:7a:55:cf:99:25:a9:47:17:b4:
+ 09:0a:bb:2a:a2:c3:f2:e8:3b:e6:c2:03:b2:ad:96:c4:ca:87:
+ 76:cb:71:96:e3:c9:7a:8b:4d:6d:f3:7d:b8:31:7d:63:47:2e:
+ a5:dd:f8:61:50:11:9d:13:f4:85:ce:58:10:e2:9a:32:87:03:
+ 48:04:21:52:0f:db:74:7d:ce:c6:ad:e6:8f:ce:f6:b7:8b:1a:
+ 86:11:60:41:0c:ce:6d:04:20:b7:af:44:bc:7c:d7:80:06:2e:
+ a4:a6:61:c7:c0:ed:9a:ac:ac:60:bf:e1:2a:a9:1a:33:5f:42:
+ 02:ec:05:45:47:52:8a:87:27:06:99:16:50:8d:42:72:0f:b6:
+ b2:a0:58:69:09:d6:86:c8:fd:3d:94:f1:88:86:08:bc:56:c0:
+ 7e:ec:38:a7:62:88:0a:55:44:42:41:82:c3:37:13:f7:85:c3:
+ f2:0c:5c:d0:5a:44:e1:ab:a5:2f:41:7d:44:25:6c:c4:53:67:
+ 02:87:4d:98:74:d8:ad:95:e2:0d:fd:8c:b9:25:8a:98:0b:9c:
+ 11:79:e9:34:64:f3:5f:f6:96:cf:96:24:4d:92:54:66:19:19:
+ 3d:d5:58:6e:2f:27:c9:ae:b7:b0:69:6a:b8:82:75:04:52:40:
+ 66:87:5e:c1:69:b8:d5:bd:5c:48:8b:4a:16:58:8d:51:f4:af:
+ 5f:ba:2a:0c:cc:d2:60:5a:d3:e2:e3:ab:90:62:d2:fa:a5:45:
+ 25:bc:00:b7:a5:ba:51:cd:dc:de:f6:08:a8:3e:99:29:a4:1d:
+ 75:e8:dc:ed:ce:86:53:77:56:8e:fd:e2:3b:e1:1b:04:07:25:
+ 27:a7:1e:97:a8:57:12:e2:40:04:d6:30:86:03:9e:ac:bf:da:
+ f7:bf:e1:41:26:04:bc:f2:d6:26:b5:4a:83:d7:5b:3c:d6:67:
+ 80:a5:fa:53:e7:0e:84:e8:73:28:fb:ba:15:d0:bd:a5:a9:30:
+ e9:e6:42:66:5a:39:ed:ee
+-----BEGIN CERTIFICATE-----
+MIIFSTCCAzGgAwIBAgIUPZV/yh+MD8hpLAGZTrVSMQNbnfEwDQYJKoZIhvcNAQEL
+BQAwLDELMAkGA1UEBhMCS1oxHTAbBgNVBAMTFFFhem5ldCBUcnVzdCBOZXR3b3Jr
+MB4XDTE2MDIwMjA1NDEwMFoXDTQ2MDIwMjA1NDEwMFowLDELMAkGA1UEBhMCS1ox
+HTAbBgNVBAMTFFFhem5ldCBUcnVzdCBOZXR3b3JrMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEA7h21UOirIlpNf3QgRyiTUnRKqrB4MgVTvs/Gq62AQqD8
+sBex3K+a2FmG77xWXUhbvc4MAZ/dnX0oziZ+7iV7iQp4tNuIiMxAO9RR2N8AAAyZ
+uHN+J7jcDjYsHvqXRLxepK47GDMjDTwDfb37pXNgVNhkm3d4cZgRjlSXWPbFV6Fw
+eOdmxWOIqhus4eTf7lKgIjhUMwiDs/Gz9dnTTkgG6iOh78qAmFQ0IqxAAZqHMt+r
+Ec1aXIHC/P2MrwL0zCr+kREv0bUbTwHAHlt+dy3++IcE7b81hy6QabUZBo7ApxUd
+puGcrGsRPvWhIMWTNj7FE6aBFEPAjVq4XPcOCfSIBH9A2fyj5PMueMtlCzD6FSSk
+bVu0hdhyrnZAe0b0knBLE58EOvDPP88OWoNsPs+WykZAQo3FX1fdU34dpzaTEx+G
+oMqZ8cb3bVbO+NUIvhGnvG6/JmoQIYjiRnvj/O8qqKgm2gjmADfliuuN8LBOl2yN
+WeqLjsYAM9mr9xOFs8lwPCCXpW/sWqjVs2mEoeVybGBi0MIyfv3cqIiliEGCI4aR
+P0+Pm1VI6JVobDFbwAgvrFniUuSxmDFVUcWoM+jEFN7kbekuEinYDxOEQVSs5WK4
+W4txDGpudGzmrkBxlXBaWqfuqG7u0/Pu3Jq6a0v8TjzVRJgTcGlI0vNUUIfJ56cC
+AwEAAaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU9JS/3lC222skPZ73
+vjquNtf7DgUwHwYDVR0jBBgwFoAU9JS/3lC222skPZ73vjquNtf7DgUwDgYDVR0P
+AQH/BAQDAgFGMA0GCSqGSIb3DQEBCwUAA4ICAQCxhROILS3MrJB5QqEk/5eeFtnb
+hvpz/cOntClxnD+0AYDscZieT7qn9fXYyRSzjZ8ZmfFGRUQILPepReuNLe3AAacG
+iziWb5Xr8zEsJrLQPLX1s0PflBmH651WvjoRKk6fpU4LRj0rTzm1EUJa03PojfMJ
+SBJ17PdKyffdGwEkjI9LZGxwGP96Vc+ZJalHF7QJCrsqosPy6DvmwgOyrZbEyod2
+y3GW48l6i01t8324MX1jRy6l3fhhUBGdE/SFzlgQ4poyhwNIBCFSD9t0fc7GreaP
+zva3ixqGEWBBDM5tBCC3r0S8fNeABi6kpmHHwO2arKxgv+EqqRozX0IC7AVFR1KK
+hycGmRZQjUJyD7ayoFhpCdaGyP09lPGIhgi8VsB+7DinYogKVURCQYLDNxP3hcPy
+DFzQWkThq6UvQX1EJWzEU2cCh02YdNitleIN/Yy5JYqYC5wReek0ZPNf9pbPliRN
+klRmGRk91VhuLyfJrrewaWq4gnUEUkBmh17BabjVvVxIi0oWWI1R9K9fuioMzNJg
+WtPi46uQYtL6pUUlvAC3pbpRzdze9gioPpkppB116NztzoZTd1aO/eI74RsEByUn
+px6XqFcS4kAE1jCGA56sv9r3v+FBJgS88tYmtUqD11s81meApfpT5w6E6HMo+7oV
+0L2lqTDp5kJmWjnt7g==
+-----END CERTIFICATE-----
diff --git a/net/data/ssl/blocklist/README.md b/net/data/ssl/blocklist/README.md
index 237a84c..84f46f2 100644
--- a/net/data/ssl/blocklist/README.md
+++ b/net/data/ssl/blocklist/README.md
@@ -277,6 +277,12 @@
* [3d3d823fad13dfeef32da580166d4a4992bed5a22d695d12c8b08cc3463c67a2.pem](3d3d823fad13dfeef32da580166d4a4992bed5a22d695d12c8b08cc3463c67a2.pem)
* [c43807a64c51a3fbde5421011698013d8b46f4e315c46186dc23aea2670cd34f.pem](c43807a64c51a3fbde5421011698013d8b46f4e315c46186dc23aea2670cd34f.pem)
+### Qaznet Trust Network
+
+For details, see <https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html>
+
+ * [00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem](00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem)
+
### revoked.badssl.com
* [2e0f66a9f9e764c33008482058fe0d92fc0ec0b122fbe994ed7bf6463668cdd4.pem](2e0f66a9f9e764c33008482058fe0d92fc0ec0b122fbe994ed7bf6463668cdd4.pem)
