Hello, I am requesting an update to certificate-roots pkg. I am specifically interested in

ISRG Root YR

because our current certificate is running out in 2030. No rush 🙂

Toit's certificate roots are extracted from Mozilla. Mozilla hasn't added this root yet. That's a long process which can take up to two years (but is usually faster). Root YR is cross-signed by ISRG Root X1, but Toit only accepts this if the server also sends the complete cross-signed chain (leaf -> YR1 -> Root YR signed by ISRG Root X1). If you have any say in how the certificates are sent, that's the cleanest solution (for now).

It works for now, the chain does include the complete chain leaf + YR1 + Root YR. The root is very new so I do not expect it to be added to Mozilla this year. If the roots are extended from Mozilla then I am sure it will be added in time. Thanks