Closed
Description
https://www.theregister.com/2022/12/02/mozilla_microsoft_trustcor/ for a summary and https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-government-connections/ for more details.
tl;dr Microsoft and Mozilla now distrust TrustCor-issued certificates; Microsoft uses a Nov 1 cutoff data, Mozilla Nov 30. I suggest we use Nov 1, too.
Currently still trusted:
$ git rev-parse @
ab064d12b79d14a3d02ba420138cc9d24169a951
$ git grep -i trustcor src/node_root_certs.h
src/node_root_certs.h:/* TrustCor RootCert CA-1 */
src/node_root_certs.h:/* TrustCor RootCert CA-2 */
src/node_root_certs.h:/* TrustCor ECA-1 */
cc @nodejs/crypto