APNs is changing root certificate from GeoTrust to Comodo AAA Certificate Services on March 29

[reivilibre]

Vishnups in the Sygnal channel kindly alerted me/us to the fact that APNs is changing which root certificate they will use:

On March 29, 2021, token and certificate-based HTTP/2 connections to the Apple Push Notification service must incorporate the new root certificate (AAACertificateServices 5/12/2020) which replaces the old GeoTrust Global CA root certificate. To ensure a seamless transition and to avoid push notification delivery failures, verify that both the old and new root certificates for the HTTP/2 interface are included in the Trust Store of each of your notification servers before March 29.

— https://developer.apple.com/news/?id=7gx0a2lp

This is probably good news for many because the old root certificate wasn't trusted by Debian anymore.

Things it seems we should do:

• revert the old GeoTrust certificate from getting specially added into the Docker image Docker: Include Root CA cert needed for APNs #141 (after March 29)
• check the Docker image has the new root certificate present (if it doesn't for some reason, that will need a new release being pushed out for Docker users before March 29)
• alert Sygnal users to check this, if it seems like this may pose some trouble? Sounds like Apple has already sent out e-mails.

The certificate in question looks like this (AAACertificateServices.crt found here), path on an Ubuntu system (I presume are the same on any Debian system):

oli@bbm-neon:~/Downloads$ sha256sum AAACertificateServices.crt 
a5ddabd1602ae1c66ce11ad078e734cc473dcb8e9f573037832d8536ae3de90b  AAACertificateServices.crt
oli@bbm-neon:~/Downloads$ sha256sum /etc/ssl/certs/Comodo_AAA_Services_root.pem 
a5ddabd1602ae1c66ce11ad078e734cc473dcb8e9f573037832d8536ae3de90b  /etc/ssl/certs/Comodo_AAA_Services_root.pem

[reivilibre]

Looks like the latest Docker image has it, at least:

oli@bbm-neon:~$ docker run -it --rm --entrypoint bash --name s1 matrixdotorg/sygnal:latest 
root@1fcb0d0eaebb:/# cd /etc/ssl/certs/
root@1fcb0d0eaebb:/etc/ssl/certs# sha256sum Comodo_AAA_Services_root.pem 
a5ddabd1602ae1c66ce11ad078e734cc473dcb8e9f573037832d8536ae3de90b  Comodo_AAA_Services_root.pem

[csett86]

I opened #208 to remove the now unnecessary GeoTrust from the docker image.

[reivilibre]

Fixed by #208