Skip to content

Add Google Android Key Attestation CA1 trust anchor - #820

Merged
MasterKale merged 3 commits into
masterfrom
fix/816-update-android-key-trust-anchors
Oct 28, 2026
Merged

MasterKale merged 3 commits into
masterfrom
fix/816-update-android-key-trust-anchors

Conversation

@MasterKale

Copy link
Copy Markdown
Owner

This PR adds the recent "Key Attestation CA1" trust anchor that Google details over at https://developer.android.com/privacy-and-security/security-key-attestation#root_certificate:

-----BEGIN CERTIFICATE-----
MIICIjCCAaigAwIBAgIRAISp0Cl7DrWK5/8OgN52BgUwCgYIKoZIzj0EAwMwUjEc
MBoGA1UEAwwTS2V5IEF0dGVzdGF0aW9uIENBMTEQMA4GA1UECwwHQW5kcm9pZDET
MBEGA1UECgwKR29vZ2xlIExMQzELMAkGA1UEBhMCVVMwHhcNMjUwNzE3MjIzMjE4
WhcNMzUwNzE1MjIzMjE4WjBSMRwwGgYDVQQDDBNLZXkgQXR0ZXN0YXRpb24gQ0Ex
MRAwDgYDVQQLDAdBbmRyb2lkMRMwEQYDVQQKDApHb29nbGUgTExDMQswCQYDVQQG
EwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABCPaI3FO3z5bBQo8cuiEas4HjqCt
G/mLFfRT0MsIssPBEEU5Cfbt6sH5yOAxqEi5QagpU1yX4HwnGb7OtBYpDTB57uH5
Eczm34A5FNijV3s0/f0UPl7zbJcTx6xwqMIRq6NCMEAwDwYDVR0TAQH/BAUwAwEB
/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFIyuyz7RkOb3NaBqQ5lZuA0QepA
MAoGCCqGSM49BAMDA2gAMGUCMETfjPO/HwqReR2CS7p0ZWoD/LHs6hDi422opifH
EUaYLxwGlT9SLdjkVpz0UUOR5wIxAIoGyxGKRHVTpqpGRFiJtQEOOTp/+s1GcxeY
uR2zh/80lQyu9vAFCj6E4AXc+osmRg==
-----END CERTIFICATE-----

The "Google Hardware Attestation Root 1" trust anchor is also being removed in this PR as it expired back on May 24, 2026.

Fixes #816.

@MasterKale MasterKale added the package:server @simplewebauthn/server label Oct 28, 2026
@MasterKale
MasterKale merged commit a0d9d94 into master Oct 28, 2026
15 checks passed
@MasterKale
MasterKale deleted the fix/816-update-android-key-trust-anchors branch October 28, 2026 20:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

package:server @simplewebauthn/server

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Default android-key roots are missing Google's new Key Attestation CA1 (ECDSA P-384) root

1 participant