Merge remote-tracking branch 'github/bug-1305' into test2-1260test2-1260

# Conflicts:
#	pages/index/3.php

13 files changed, 387 insertions, 28 deletions

diff --git a/pages/index/3.php b/pages/index/3.php
index 198ecd1..df29c5f 100644
--- a/pages/index/3.php
+++ b/pages/index/3.php
@@ -18,21 +18,13 @@
 
 <p><?php echo sprintf(_("You are bound by the %s Root Distribution Licence %s for any re-distributions of CAcert's roots."),"<a href='/policy/RootDistributionLicense.html'>","</a>")?></p>
 
-<h3><?php echo _("Windows Installer") ?></h3>
-<ul class="no_indent">
-	<li><?php printf(_("%s Windows installer package %s for browsers that use the Windows certificate store %s (for example Internet Explorer, Chrome on Windows and Safari on Windows)"), '<a href="certs/CAcert_Root_Certificates.msi">', '</a>', '<br/>')?></li>
-	<li><?php echo _("SHA1 Hash:") ?> 2db1957db31aa0d778d1a65ea146760ee1e67611</li>
-	<li><?php echo _("SHA256 Hash:") ?> 88883f2e3117bae6f43922fbaef8501b94efe4143c12116244ca5d0c23bcbb16</li>
-</ul>
-
 <h3><?php echo _("Class 1 PKI Key")?></h3>
 <ul class="no_indent">
 	<li><a href="certs/root.crt"><?php echo _("Root Certificate (PEM Format)")?></a></li>
 	<li><a href="certs/root.der"><?php echo _("Root Certificate (DER Format)")?></a></li>
 	<li><a href="certs/root.txt"><?php echo _("Root Certificate (Text Format)")?></a></li>
 	<li><a href="<?php echo $_SERVER['HTTPS']?"https":"http"?>://crl.cacert.org/revoke.crl">CRL</a></li>
-	<li><?php echo _("SHA1 Fingerprint:")?> 13:5C:EC:36:F4:9C:B8:E9:3B:1A:B2:70:CD:80:88:46:76:CE:8F:33</li>
-	<li><?php echo _("MD5 Fingerprint:")?> A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B</li>
+	<li><?=_("SHA256 fingerprint:")?> 07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5</li>
 </ul>
 
 <h3><?php echo _("Class 3 PKI Key")?></h3>
@@ -41,12 +33,7 @@
 	<li><a href="certs/class3.der"><?php echo _("Intermediate Certificate (DER Format)")?></a></li>
 	<li><a href="certs/class3.txt"><?php echo _("Intermediate Certificate (Text Format)")?></a></li>
 	<li><a href="<?php echo $_SERVER['HTTPS']?"https":"http"?>://crl.cacert.org/class3-revoke.crl">CRL</a></li>
-<?php /*
-  class3 subroot fingerprint updated: 2011-05-23  class3 Re-sign project
-  https://wiki.cacert.org/Roots/Class3ResignProcedure/Migration
-*/ ?>
-	<li><?php echo _("SHA1 Fingerprint:")?> AD:7C:3F:64:FC:44:39:FE:F4:E9:0B:E8:F4:7C:6C:FA:8A:AD:FD:CE</li>
-	<li><?php echo _("MD5 Fingerprint:")?> F7:25:12:82:4E:67:B5:D0:8D:92:B7:7C:0B:86:7A:42</li>
+    <li><?=_("SHA256 fingerprint:")?> F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544</li>
 </ul>
 
 <h3><?php echo _("GPG Key")?></h3>
diff --git a/www/cap.html.php b/www/cap.html.php
index 3522f1c..b83d52d 100644
--- a/www/cap.html.php
+++ b/www/cap.html.php
@@ -44,12 +44,12 @@
 	echo '<tbody>', "\n";
 	echo '<tr><td>', "\n";
 	echo '<tr>', "\n";
-	echo '    <td align="left"><font size=-7>'._("CAcert's Root Certificate sha1 fingerprints").'</font></td>', "\n";
-	echo '    <td align="right"><font size=-7>class 1: 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33</font></td>', "\n";
+	echo '    <td align="left"><font size=-7>'._("CAcert's Root Certificate sha256 fingerprints (since 2019)").'</font></td>', "\n";
+	echo '    <td align="right"><font size=-7>class 1: 07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5</font></td>', "\n";
 	echo '</tr>', "\n";
 	echo '<tr>', "\n";
 	echo '    <td></td>', "\n";
-	echo '    <td align="right"><font size=-7>class 3: AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE</font></td>', "\n";
+	echo '    <td align="right"><font size=-7>class 3: F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544</font></td>', "\n";
 	echo '<tr>', "\n";
 	echo '</font>', "\n";
 	echo '</td>', "\n";
diff --git a/www/cap.php b/www/cap.php
index c3be872..51a23ec 100644
--- a/www/cap.php
+++ b/www/cap.php
@@ -48,14 +48,18 @@
 			$this->SetFont('Arial','I',8);
 			if($_SESSION['_config']['language'] == "ja")
 				$this->SetFont('SJIS','I',8);
-			$this->Cell(0,0,'CAcert Inc. - PO Box 66 - Oatley NSW 2223 -  Australia - http://www.CAcert.org',0,0,'C');
+			$this->Cell(0,0,'CAcert Inc. - Hangar 10 Airfield Avenue - Murwillumbah NSW 2484 -  Australia - http://www.CAcert.org',0,0,'C');
 			$this->Ln(3);
 			$this->SetFont('Arial','',6);
 			if($_SESSION['_config']['language'] == "ja")
 				$this->SetFont('SJIS','',6);
-			$this->Cell(0,0, recode($_SESSION['_config']['recode'], _("CAcert's Root Certificate fingerprints")).": A6:1B:37:5E:39:0D:9C:36:54:EE:BD:20:31:46:1F:6B "._("and")." 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33",0,0,'C');
-			$this->SetLineWidth(0.05);
-			$this->Line(1, 43, $this->w - 1, 43);
+			$this->Cell(0,0, recode($_SESSION['_config']['recode'], _("CAcert's Root Certificate fingerprints"). _(" (since 2019)")),0,0,'C');
+			$this->ln(3);
+			$this->Cell(0,0, recode($_SESSION['_config']['recode'], "SHA1: root: DDFC DA54 1E75 77AD DCA8 7E88 27A9 8A50 6032 52A5 "._("and")." class3: A7C4 8FBE 6B02 6DBD 0EC1 B465 B88D D813 EE1D EFA0"),0,0,'C');
+			$this->ln(3);
+			$this->Cell(0,0, recode($_SESSION['_config']['recode'], "SHA256: root: 07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5 "._("and")." class3: F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544"),0,0,'C');
+			$this->SetLineWidth(0.05); // added 3 points to the abcissa 43 -> 46 to get second line fingerprints
+			$this->Line(1, 46, $this->w - 1, 46);
 			$this->SetLineWidth(0.2);
 		}
 
@@ -69,7 +73,7 @@
 				$date = date("Y-m-d");
 
 			// Show text blurb at top of page
-			$this->SetY(45);
+			$this->SetY(48); // added 3 points to the abcissa 45 -> 48 to get second line fingerprints
 			$this->SetFont('Arial','',10);
 			if($_SESSION['_config']['language'] == "ja")
 				$this->SetFont('SJIS','',10);
diff --git a/www/capnew.php b/www/capnew.php
index a57bde3..7c610ef 100644
--- a/www/capnew.php
+++ b/www/capnew.php
@@ -311,6 +311,10 @@ define('ARBIT', WIKI.'/ArbitrationForum');
 define('CCA', 'CAcertCommunityAgreement'); // default policy to print
 define('POLICY','policy/'); // default polciy doc directory
 define('EXT','.html'); // default polciy doc extention, should be html
+/* finger print CAcert Root Key SHA256 since 2019*/ // should obtain this automatically
+define('CLASS1_SHA256','07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5');
+define('CLASS3_SHA256','F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544');
+/* finger print CAcert Root Key */  // not to use since 2019
 /* finger print CAcert Root Key */ // should obtain this automatically
 define('CLASS1_SHA1','135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33');
 define('CLASS3_SHA1','AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE');
@@ -918,7 +922,7 @@ class CAPPDF extends TCPDF {
             $this->SetXY($savex,$savey);
 
             // sha1 fingerprint CAcert rootkeys class 1 and class 3
-            $strg = $this->unhtmlentities( _("CAcert's Root Certificate sha1 fingerprints") ) . ', class 1: '. CLASS1_SHA1 . ', class 3: ' . CLASS3_SHA1;
+            $strg = $this->unhtmlentities( _("CAcert's Root Certificate sha256 fingerprints (since 2019)") ) . ', class 1: '. CLASS1_SHA256 . ', class 3: ' . CLASS3_SHA256;
             $this->Ln(3); $this->SetX($this->lMargin);
             $this->SetFont(FONT,'',F_SIZE * $this->colwidth / ($this->GetStringWidth($strg) +1));
             $this->Cell($this->colwidth,10, $strg,0,0,'C',0,NULL);
diff --git a/www/certs/CAcert_Root_Certificates_X0F_X0E.msi b/www/certs/CAcert_Root_Certificates_X0F_X0E.msi
new file mode 100644
index 0000000..19f2593
--- /dev/null
+++ b/www/certs/CAcert_Root_Certificates_X0F_X0E.msi
diff --git a/www/certs/class3_X0E.crt b/www/certs/class3_X0E.crt
new file mode 100644
index 0000000..d358c12
--- /dev/null
+++ b/www/certs/class3_X0E.crt
@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIG0jCCBLqgAwIBAgIBDjANBgkqhkiG9w0BAQsFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0xMTA1MjMxNzQ4MDJaFw0yMTA1MjAxNzQ4MDJaMFQxFDAS
+BgNVBAoTC0NBY2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5v
+cmcxHDAaBgNVBAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCrSTURSHzSJn5TlM9Dqd0o10Iqi/OHeBlYfA+e2ol9
+4fvrcpANdKGWZKufoCSZc9riVXbHF3v1BKxGuMO+f2SNEGwk82GcwPKQ+lHm9WkB
+Y8MPVuJKQs/iRIwlKKjFeQl9RrmK8+nzNCkIReQcn8uUBByBqBSzmGXEQ+xOgo0J
+0b2qW42S0OzekMV/CsLj6+YxWl50PpczWejDAz1gM7/30W9HxM3uYoNSbi4ImqTZ
+FRiRpoWSR7CuSOtttyHshRpocjWr//AQXcD0lKdq1TuSfkyQBX6TwSyLpI5idBVx
+bgtxA+qvFTia1NIFcm+M+SvrWnIl+TlG43IbPgTDZCciECqKT1inA62+tC4T7V2q
+SNfVfdQqe1z6RgRQ5MwOQluM7dvyz/yWk+DbETZUYjQ4jwxgmzuXVjit89Jbi6Bb
+6k6WuHzX1aCGcEDTkSm3ojyt9Yy7zxqSiuQ0e8DYbF/pCsLDpyCaWt8sXVJcukfV
+m+8kKHA4IC/VfynAskEDaJLM4JzMl0tF7zoQCqtwOpiVcK01seqFK6QcgCExqa5g
+eoAmSAC4AcCTY1UikTxW56/bOiXzjzFU6iaLgVn5odFTEcV7nQP2dBHgbbEsPyyG
+kZlxmqZ3izRg0RS0LKydr4wQ05/EavhvE/xzWfdmQnQeiuP43NJvmJzLR5iVQAX7
+6QIDAQABo4IBiDCCAYQwHQYDVR0OBBYEFHWocWBMiBPweNmJd7VtxYnfvLF6MA8G
+A1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUHAQEEUTBPMCMGCCsGAQUFBzABhhdodHRw
+Oi8vb2NzcC5DQWNlcnQub3JnLzAoBggrBgEFBQcwAoYcaHR0cDovL3d3dy5DQWNl
+cnQub3JnL2NhLmNydDBKBgNVHSAEQzBBMD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUH
+AgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwNAYJYIZI
+AYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAw
+UAYJYIZIAYb4QgENBEMWQVRvIGdldCB5b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3Ig
+RlJFRSwgZ28gdG8gaHR0cDovL3d3dy5DQWNlcnQub3JnMB8GA1UdIwQYMBaAFBa1
+MhvUx/Pg5o7zvdKwOu6yORjRMA0GCSqGSIb3DQEBCwUAA4ICAQBakBbQNiNWZJWJ
+vI+spCDJJoqp81TkQBg/SstDxpt2CebKVKeMlAuSaNZZuxeXe2nqrdRM4SlbKBWP
+3Rn0lVknlxjbjwm5fXh6yLBCVrXq616xJtCXE74FHIbhNAUVsQa92jzQE2OEbTWU
+0D6Zghih+j+cN0eFiuDuc3iC1GuZMb/Zw21AXbkVxzZ4ipaL0YQgsSt1P22ipb69
+6OLkrURctgY2cHS4pI62VpRgkwJ/Lw2n+C9vtukozMhrlPSTA0OhNEGiGp2hRpWa
+hiG+HGcIYfAV9v7og3dO9TnS0XDbbk1RqXPpc/DtrJWzmZN0O4KIx0OtLJJWG9zp
+9JrJyO6USIFYgar0U8HHHoTccth+8vJirz7Aw4DlCujo27OoIksg3OzgX/DkvWYl
+0J8EMlXoH0iTv3qcroQItOUFsgilbjRba86Q5kLhnCxjdW2CbbNSp8vlZn0uFxd8
+spxQcXs0CIn19uvcQIo4Z4uQ+00Lg9xI9YFV9S2MbSanlNUlvbB4UvHkel0p6bGt
+Amp1dJBSkZOFm0Z6ek+G7w7R1aTifjGJrdw032O+VIKwCgu8DdskR0w0B68ydZn0
+ATnMnr5ExvcWkZBtCgQa2NvSKrcQnlaqo9icEF4XevI/VTezlb1LjYMWHVd5R6C2
+p4wTyVBIM8hjrLcKiChF43GRJtne7w==
+-----END CERTIFICATE-----
diff --git a/www/certs/class3_X0E.der b/www/certs/class3_X0E.der
new file mode 100644
index 0000000..417b714
--- /dev/null
+++ b/www/certs/class3_X0E.der
diff --git a/www/certs/class3_X0E.txt b/www/certs/class3_X0E.txt
new file mode 100644
index 0000000..de63961
--- /dev/null
+++ b/www/certs/class3_X0E.txt
@@ -0,0 +1,139 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 14 (0xe)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+        Validity
+            Not Before: May 23 17:48:02 2011 GMT
+            Not After : May 20 17:48:02 2021 GMT
+        Subject: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:ab:49:35:11:48:7c:d2:26:7e:53:94:cf:43:a9:
+                    dd:28:d7:42:2a:8b:f3:87:78:19:58:7c:0f:9e:da:
+                    89:7d:e1:fb:eb:72:90:0d:74:a1:96:64:ab:9f:a0:
+                    24:99:73:da:e2:55:76:c7:17:7b:f5:04:ac:46:b8:
+                    c3:be:7f:64:8d:10:6c:24:f3:61:9c:c0:f2:90:fa:
+                    51:e6:f5:69:01:63:c3:0f:56:e2:4a:42:cf:e2:44:
+                    8c:25:28:a8:c5:79:09:7d:46:b9:8a:f3:e9:f3:34:
+                    29:08:45:e4:1c:9f:cb:94:04:1c:81:a8:14:b3:98:
+                    65:c4:43:ec:4e:82:8d:09:d1:bd:aa:5b:8d:92:d0:
+                    ec:de:90:c5:7f:0a:c2:e3:eb:e6:31:5a:5e:74:3e:
+                    97:33:59:e8:c3:03:3d:60:33:bf:f7:d1:6f:47:c4:
+                    cd:ee:62:83:52:6e:2e:08:9a:a4:d9:15:18:91:a6:
+                    85:92:47:b0:ae:48:eb:6d:b7:21:ec:85:1a:68:72:
+                    35:ab:ff:f0:10:5d:c0:f4:94:a7:6a:d5:3b:92:7e:
+                    4c:90:05:7e:93:c1:2c:8b:a4:8e:62:74:15:71:6e:
+                    0b:71:03:ea:af:15:38:9a:d4:d2:05:72:6f:8c:f9:
+                    2b:eb:5a:72:25:f9:39:46:e3:72:1b:3e:04:c3:64:
+                    27:22:10:2a:8a:4f:58:a7:03:ad:be:b4:2e:13:ed:
+                    5d:aa:48:d7:d5:7d:d4:2a:7b:5c:fa:46:04:50:e4:
+                    cc:0e:42:5b:8c:ed:db:f2:cf:fc:96:93:e0:db:11:
+                    36:54:62:34:38:8f:0c:60:9b:3b:97:56:38:ad:f3:
+                    d2:5b:8b:a0:5b:ea:4e:96:b8:7c:d7:d5:a0:86:70:
+                    40:d3:91:29:b7:a2:3c:ad:f5:8c:bb:cf:1a:92:8a:
+                    e4:34:7b:c0:d8:6c:5f:e9:0a:c2:c3:a7:20:9a:5a:
+                    df:2c:5d:52:5c:ba:47:d5:9b:ef:24:28:70:38:20:
+                    2f:d5:7f:29:c0:b2:41:03:68:92:cc:e0:9c:cc:97:
+                    4b:45:ef:3a:10:0a:ab:70:3a:98:95:70:ad:35:b1:
+                    ea:85:2b:a4:1c:80:21:31:a9:ae:60:7a:80:26:48:
+                    00:b8:01:c0:93:63:55:22:91:3c:56:e7:af:db:3a:
+                    25:f3:8f:31:54:ea:26:8b:81:59:f9:a1:d1:53:11:
+                    c5:7b:9d:03:f6:74:11:e0:6d:b1:2c:3f:2c:86:91:
+                    99:71:9a:a6:77:8b:34:60:d1:14:b4:2c:ac:9d:af:
+                    8c:10:d3:9f:c4:6a:f8:6f:13:fc:73:59:f7:66:42:
+                    74:1e:8a:e3:f8:dc:d2:6f:98:9c:cb:47:98:95:40:
+                    05:fb:e9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                75:A8:71:60:4C:88:13:F0:78:D9:89:77:B5:6D:C5:89:DF:BC:B1:7A
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            Authority Information Access: 
+                OCSP - URI:http://ocsp.CAcert.org/
+                CA Issuers - URI:http://www.CAcert.org/ca.crt
+
+            X509v3 Certificate Policies: 
+                Policy: 1.3.6.1.4.1.18506
+                  CPS: http://www.CAcert.org/index.php?id=10
+
+            Netscape CA Policy Url: 
+                http://www.CAcert.org/index.php?id=10
+            Netscape Comment: 
+                To get your own certificate for FREE, go to http://www.CAcert.org
+            X509v3 Authority Key Identifier: 
+                keyid:16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
+
+    Signature Algorithm: sha256WithRSAEncryption
+         5a:90:16:d0:36:23:56:64:95:89:bc:8f:ac:a4:20:c9:26:8a:
+         a9:f3:54:e4:40:18:3f:4a:cb:43:c6:9b:76:09:e6:ca:54:a7:
+         8c:94:0b:92:68:d6:59:bb:17:97:7b:69:ea:ad:d4:4c:e1:29:
+         5b:28:15:8f:dd:19:f4:95:59:27:97:18:db:8f:09:b9:7d:78:
+         7a:c8:b0:42:56:b5:ea:eb:5e:b1:26:d0:97:13:be:05:1c:86:
+         e1:34:05:15:b1:06:bd:da:3c:d0:13:63:84:6d:35:94:d0:3e:
+         99:82:18:a1:fa:3f:9c:37:47:85:8a:e0:ee:73:78:82:d4:6b:
+         99:31:bf:d9:c3:6d:40:5d:b9:15:c7:36:78:8a:96:8b:d1:84:
+         20:b1:2b:75:3f:6d:a2:a5:be:bd:e8:e2:e4:ad:44:5c:b6:06:
+         36:70:74:b8:a4:8e:b6:56:94:60:93:02:7f:2f:0d:a7:f8:2f:
+         6f:b6:e9:28:cc:c8:6b:94:f4:93:03:43:a1:34:41:a2:1a:9d:
+         a1:46:95:9a:86:21:be:1c:67:08:61:f0:15:f6:fe:e8:83:77:
+         4e:f5:39:d2:d1:70:db:6e:4d:51:a9:73:e9:73:f0:ed:ac:95:
+         b3:99:93:74:3b:82:88:c7:43:ad:2c:92:56:1b:dc:e9:f4:9a:
+         c9:c8:ee:94:48:81:58:81:aa:f4:53:c1:c7:1e:84:dc:72:d8:
+         7e:f2:f2:62:af:3e:c0:c3:80:e5:0a:e8:e8:db:b3:a8:22:4b:
+         20:dc:ec:e0:5f:f0:e4:bd:66:25:d0:9f:04:32:55:e8:1f:48:
+         93:bf:7a:9c:ae:84:08:b4:e5:05:b2:08:a5:6e:34:5b:6b:ce:
+         90:e6:42:e1:9c:2c:63:75:6d:82:6d:b3:52:a7:cb:e5:66:7d:
+         2e:17:17:7c:b2:9c:50:71:7b:34:08:89:f5:f6:eb:dc:40:8a:
+         38:67:8b:90:fb:4d:0b:83:dc:48:f5:81:55:f5:2d:8c:6d:26:
+         a7:94:d5:25:bd:b0:78:52:f1:e4:7a:5d:29:e9:b1:ad:02:6a:
+         75:74:90:52:91:93:85:9b:46:7a:7a:4f:86:ef:0e:d1:d5:a4:
+         e2:7e:31:89:ad:dc:34:df:63:be:54:82:b0:0a:0b:bc:0d:db:
+         24:47:4c:34:07:af:32:75:99:f4:01:39:cc:9e:be:44:c6:f7:
+         16:91:90:6d:0a:04:1a:d8:db:d2:2a:b7:10:9e:56:aa:a3:d8:
+         9c:10:5e:17:7a:f2:3f:55:37:b3:95:bd:4b:8d:83:16:1d:57:
+         79:47:a0:b6:a7:8c:13:c9:50:48:33:c8:63:ac:b7:0a:88:28:
+         45:e3:71:91:26:d9:de:ef
+-----BEGIN CERTIFICATE-----
+MIIG0jCCBLqgAwIBAgIBDjANBgkqhkiG9w0BAQsFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0xMTA1MjMxNzQ4MDJaFw0yMTA1MjAxNzQ4MDJaMFQxFDAS
+BgNVBAoTC0NBY2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5v
+cmcxHDAaBgNVBAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCrSTURSHzSJn5TlM9Dqd0o10Iqi/OHeBlYfA+e2ol9
+4fvrcpANdKGWZKufoCSZc9riVXbHF3v1BKxGuMO+f2SNEGwk82GcwPKQ+lHm9WkB
+Y8MPVuJKQs/iRIwlKKjFeQl9RrmK8+nzNCkIReQcn8uUBByBqBSzmGXEQ+xOgo0J
+0b2qW42S0OzekMV/CsLj6+YxWl50PpczWejDAz1gM7/30W9HxM3uYoNSbi4ImqTZ
+FRiRpoWSR7CuSOtttyHshRpocjWr//AQXcD0lKdq1TuSfkyQBX6TwSyLpI5idBVx
+bgtxA+qvFTia1NIFcm+M+SvrWnIl+TlG43IbPgTDZCciECqKT1inA62+tC4T7V2q
+SNfVfdQqe1z6RgRQ5MwOQluM7dvyz/yWk+DbETZUYjQ4jwxgmzuXVjit89Jbi6Bb
+6k6WuHzX1aCGcEDTkSm3ojyt9Yy7zxqSiuQ0e8DYbF/pCsLDpyCaWt8sXVJcukfV
+m+8kKHA4IC/VfynAskEDaJLM4JzMl0tF7zoQCqtwOpiVcK01seqFK6QcgCExqa5g
+eoAmSAC4AcCTY1UikTxW56/bOiXzjzFU6iaLgVn5odFTEcV7nQP2dBHgbbEsPyyG
+kZlxmqZ3izRg0RS0LKydr4wQ05/EavhvE/xzWfdmQnQeiuP43NJvmJzLR5iVQAX7
+6QIDAQABo4IBiDCCAYQwHQYDVR0OBBYEFHWocWBMiBPweNmJd7VtxYnfvLF6MA8G
+A1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUHAQEEUTBPMCMGCCsGAQUFBzABhhdodHRw
+Oi8vb2NzcC5DQWNlcnQub3JnLzAoBggrBgEFBQcwAoYcaHR0cDovL3d3dy5DQWNl
+cnQub3JnL2NhLmNydDBKBgNVHSAEQzBBMD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUH
+AgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwNAYJYIZI
+AYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAw
+UAYJYIZIAYb4QgENBEMWQVRvIGdldCB5b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3Ig
+RlJFRSwgZ28gdG8gaHR0cDovL3d3dy5DQWNlcnQub3JnMB8GA1UdIwQYMBaAFBa1
+MhvUx/Pg5o7zvdKwOu6yORjRMA0GCSqGSIb3DQEBCwUAA4ICAQBakBbQNiNWZJWJ
+vI+spCDJJoqp81TkQBg/SstDxpt2CebKVKeMlAuSaNZZuxeXe2nqrdRM4SlbKBWP
+3Rn0lVknlxjbjwm5fXh6yLBCVrXq616xJtCXE74FHIbhNAUVsQa92jzQE2OEbTWU
+0D6Zghih+j+cN0eFiuDuc3iC1GuZMb/Zw21AXbkVxzZ4ipaL0YQgsSt1P22ipb69
+6OLkrURctgY2cHS4pI62VpRgkwJ/Lw2n+C9vtukozMhrlPSTA0OhNEGiGp2hRpWa
+hiG+HGcIYfAV9v7og3dO9TnS0XDbbk1RqXPpc/DtrJWzmZN0O4KIx0OtLJJWG9zp
+9JrJyO6USIFYgar0U8HHHoTccth+8vJirz7Aw4DlCujo27OoIksg3OzgX/DkvWYl
+0J8EMlXoH0iTv3qcroQItOUFsgilbjRba86Q5kLhnCxjdW2CbbNSp8vlZn0uFxd8
+spxQcXs0CIn19uvcQIo4Z4uQ+00Lg9xI9YFV9S2MbSanlNUlvbB4UvHkel0p6bGt
+Amp1dJBSkZOFm0Z6ek+G7w7R1aTifjGJrdw032O+VIKwCgu8DdskR0w0B68ydZn0
+ATnMnr5ExvcWkZBtCgQa2NvSKrcQnlaqo9icEF4XevI/VTezlb1LjYMWHVd5R6C2
+p4wTyVBIM8hjrLcKiChF43GRJtne7w==
+-----END CERTIFICATE-----
diff --git a/www/certs/root_X0F.crt b/www/certs/root_X0F.crt
new file mode 100644
index 0000000..8ef0716
--- /dev/null
+++ b/www/certs/root_X0F.crt
@@ -0,0 +1,40 @@
+-----BEGIN CERTIFICATE-----
+MIIG7jCCBNagAwIBAgIBDzANBgkqhkiG9w0BAQsFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
+BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
+MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
+ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
+8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
+zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
+fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
+w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
+G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
+epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
+laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
+QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
+fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
+YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAX8w
+ggF7MB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TAPBgNVHRMBAf8EBTAD
+AQH/MDQGCWCGSAGG+EIBCAQnFiVodHRwOi8vd3d3LmNhY2VydC5vcmcvaW5kZXgu
+cGhwP2lkPTEwMFYGCWCGSAGG+EIBDQRJFkdUbyBnZXQgeW91ciBvd24gY2VydGlm
+aWNhdGUgZm9yIEZSRUUgaGVhZCBvdmVyIHRvIGh0dHA6Ly93d3cuY2FjZXJ0Lm9y
+ZzAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLmNhY2VydC5vcmcvcmV2b2tl
+LmNybDAzBglghkgBhvhCAQQEJhYkVVJJOmh0dHA6Ly9jcmwuY2FjZXJ0Lm9yZy9y
+ZXZva2UuY3JsMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29j
+c3AuY2FjZXJ0Lm9yZzAfBgNVHSMEGDAWgBQWtTIb1Mfz4OaO873SsDrusjkY0TAN
+BgkqhkiG9w0BAQsFAAOCAgEAR5zXs6IX01JTt7Rq3b+bNRUhbO9vGBMggczo7R0q
+Ih1kdhS6WzcrDoO6PkpuRg0L3qM7YQB6pw2V+ubzF7xl4C0HWltfzPTbzAHdJtja
+JQw7QaBlmAYpN2CLB6Jeg8q/1Xpgdw/+IP1GRwdg7xUpReUA482l4MH1kf0W0ad9
+4SuIfNWQHcdLApmno/SUh1bpZyeWrMnlhkGNDKMxCCQXQ360TwFHc8dfEAaq5ry6
+cZzm1oetrkSviE2qofxvv1VFiQ+9TX3/zkECCsUB/EjPM0lxFBmu9T5Ih+Eqns9i
+vmrEIQDv9tNyJHuLsDNqbUBal7OoiPZnXk9LH+qb+pLf1ofv5noy5vX2a5OKebHe
++0Ex/A7e+G/HuOjVNqhZ9j5Nispfq9zNyOHGWD8ofj8DHwB50L1Xh5H+EbIoga/h
+JCQnRtxWkHP699T1JpLFYwapgplivF4TFv4fqp0nHTKC1x9gGrIgvuYJl1txIKmx
+XdfJzgscMzqpabhtHOMXOiwQBpWzyJkofF/w55e0LttZDBkEsilV/vW0CJsPs3eN
+aQF+iMWscGOkgLFlWsAS3HwyiYLNJo26aqyWPaIdc8E4ck7Sk08WrFrHIK3EHr4n
+1FZwmLpFAvucKqgl0hr+2jypyh5puA3KksHF3CsUzjMUvzxMhykh9zrMxQAHLBVr
+Gwc=
+-----END CERTIFICATE-----
diff --git a/www/certs/root_X0F.der b/www/certs/root_X0F.der
new file mode 100644
index 0000000..e827487
--- /dev/null
+++ b/www/certs/root_X0F.der
diff --git a/www/certs/root_X0F.txt b/www/certs/root_X0F.txt
new file mode 100644
index 0000000..428e0bc
--- /dev/null
+++ b/www/certs/root_X0F.txt
@@ -0,0 +1,142 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 15 (0xf)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+        Validity
+            Not Before: Mar 30 12:29:49 2003 GMT
+            Not After : Mar 29 12:29:49 2033 GMT
+        Subject: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:ce:22:c0:e2:46:7d:ec:36:28:07:50:96:f2:a0:
+                    33:40:8c:4b:f1:3b:66:3f:31:e5:6b:02:36:db:d6:
+                    7c:f6:f1:88:8f:4e:77:36:05:41:95:f9:09:f0:12:
+                    cf:46:86:73:60:b7:6e:7e:e8:c0:58:64:ae:cd:b0:
+                    ad:45:17:0c:63:fa:67:0a:e8:d6:d2:bf:3e:e7:98:
+                    c4:f0:4c:fa:e0:03:bb:35:5d:6c:21:de:9e:20:d9:
+                    ba:cd:66:32:37:72:fa:f7:08:f5:c7:cd:58:c9:8e:
+                    e7:0e:5e:ea:3e:fe:1c:a1:14:0a:15:6c:86:84:5b:
+                    64:66:2a:7a:a9:4b:53:79:f5:88:a2:7b:ee:2f:0a:
+                    61:2b:8d:b2:7e:4d:56:a5:13:ec:ea:da:92:9e:ac:
+                    44:41:1e:58:60:65:05:66:f8:c0:44:bd:cb:94:f7:
+                    42:7e:0b:f7:65:68:98:51:05:f0:f3:05:91:04:1d:
+                    1b:17:82:ec:c8:57:bb:c3:6b:7a:88:f1:b0:72:cc:
+                    25:5b:20:91:ec:16:02:12:8f:32:e9:17:18:48:d0:
+                    c7:05:2e:02:30:42:b8:25:9c:05:6b:3f:aa:3a:a7:
+                    eb:53:48:f7:e8:d2:b6:07:98:dc:1b:c6:34:7f:7f:
+                    c9:1c:82:7a:05:58:2b:08:5b:f3:38:a2:ab:17:5d:
+                    66:c9:98:d7:9e:10:8b:a2:d2:dd:74:9a:f7:71:0c:
+                    72:60:df:cd:6f:98:33:9d:96:34:76:3e:24:7a:92:
+                    b0:0e:95:1e:6f:e6:a0:45:38:47:aa:d7:41:ed:4a:
+                    b7:12:f6:d7:1b:83:8a:0f:2e:d8:09:b6:59:d7:aa:
+                    04:ff:d2:93:7d:68:2e:dd:8b:4b:ab:58:ba:2f:8d:
+                    ea:95:a7:a0:c3:54:89:a5:fb:db:8b:51:22:9d:b2:
+                    c3:be:11:be:2c:91:86:8b:96:78:ad:20:d3:8a:2f:
+                    1a:3f:c6:d0:51:65:87:21:b1:19:01:65:7f:45:1c:
+                    87:f5:7c:d0:41:4c:4f:29:98:21:fd:33:1f:75:0c:
+                    04:51:fa:19:77:db:d4:14:1c:ee:81:c3:1d:f5:98:
+                    b7:69:06:91:22:dd:00:50:cc:81:31:ac:12:07:7b:
+                    38:da:68:5b:e6:2b:d4:7e:c9:5f:ad:e8:eb:72:4c:
+                    f3:01:e5:4b:20:bf:9a:a6:57:ca:91:00:01:8b:a1:
+                    75:21:37:b5:63:0d:67:3e:46:4f:70:20:67:ce:c5:
+                    d6:59:db:02:e0:f0:d2:cb:cd:ba:62:b7:90:41:e8:
+                    dd:20:e4:29:bc:64:29:42:c8:22:dc:78:9a:ff:43:
+                    ec:98:1b:09:51:4b:5a:5a:c2:71:f1:c4:cb:73:a9:
+                    e5:a1:0b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            Netscape CA Policy Url: 
+                http://www.cacert.org/index.php?id=10
+            Netscape Comment: 
+                To get your own certificate for FREE head over to http://www.cacert.org
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://crl.cacert.org/revoke.crl
+
+            Netscape CA Revocation Url: 
+                URI:http://crl.cacert.org/revoke.crl
+            Authority Information Access: 
+                OCSP - URI:http://ocsp.cacert.org
+
+            X509v3 Authority Key Identifier: 
+                keyid:16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
+
+    Signature Algorithm: sha256WithRSAEncryption
+         47:9c:d7:b3:a2:17:d3:52:53:b7:b4:6a:dd:bf:9b:35:15:21:
+         6c:ef:6f:18:13:20:81:cc:e8:ed:1d:2a:22:1d:64:76:14:ba:
+         5b:37:2b:0e:83:ba:3e:4a:6e:46:0d:0b:de:a3:3b:61:00:7a:
+         a7:0d:95:fa:e6:f3:17:bc:65:e0:2d:07:5a:5b:5f:cc:f4:db:
+         cc:01:dd:26:d8:da:25:0c:3b:41:a0:65:98:06:29:37:60:8b:
+         07:a2:5e:83:ca:bf:d5:7a:60:77:0f:fe:20:fd:46:47:07:60:
+         ef:15:29:45:e5:00:e3:cd:a5:e0:c1:f5:91:fd:16:d1:a7:7d:
+         e1:2b:88:7c:d5:90:1d:c7:4b:02:99:a7:a3:f4:94:87:56:e9:
+         67:27:96:ac:c9:e5:86:41:8d:0c:a3:31:08:24:17:43:7e:b4:
+         4f:01:47:73:c7:5f:10:06:aa:e6:bc:ba:71:9c:e6:d6:87:ad:
+         ae:44:af:88:4d:aa:a1:fc:6f:bf:55:45:89:0f:bd:4d:7d:ff:
+         ce:41:02:0a:c5:01:fc:48:cf:33:49:71:14:19:ae:f5:3e:48:
+         87:e1:2a:9e:cf:62:be:6a:c4:21:00:ef:f6:d3:72:24:7b:8b:
+         b0:33:6a:6d:40:5a:97:b3:a8:88:f6:67:5e:4f:4b:1f:ea:9b:
+         fa:92:df:d6:87:ef:e6:7a:32:e6:f5:f6:6b:93:8a:79:b1:de:
+         fb:41:31:fc:0e:de:f8:6f:c7:b8:e8:d5:36:a8:59:f6:3e:4d:
+         8a:ca:5f:ab:dc:cd:c8:e1:c6:58:3f:28:7e:3f:03:1f:00:79:
+         d0:bd:57:87:91:fe:11:b2:28:81:af:e1:24:24:27:46:dc:56:
+         90:73:fa:f7:d4:f5:26:92:c5:63:06:a9:82:99:62:bc:5e:13:
+         16:fe:1f:aa:9d:27:1d:32:82:d7:1f:60:1a:b2:20:be:e6:09:
+         97:5b:71:20:a9:b1:5d:d7:c9:ce:0b:1c:33:3a:a9:69:b8:6d:
+         1c:e3:17:3a:2c:10:06:95:b3:c8:99:28:7c:5f:f0:e7:97:b4:
+         2e:db:59:0c:19:04:b2:29:55:fe:f5:b4:08:9b:0f:b3:77:8d:
+         69:01:7e:88:c5:ac:70:63:a4:80:b1:65:5a:c0:12:dc:7c:32:
+         89:82:cd:26:8d:ba:6a:ac:96:3d:a2:1d:73:c1:38:72:4e:d2:
+         93:4f:16:ac:5a:c7:20:ad:c4:1e:be:27:d4:56:70:98:ba:45:
+         02:fb:9c:2a:a8:25:d2:1a:fe:da:3c:a9:ca:1e:69:b8:0d:ca:
+         92:c1:c5:dc:2b:14:ce:33:14:bf:3c:4c:87:29:21:f7:3a:cc:
+         c5:00:07:2c:15:6b:1b:07
+-----BEGIN CERTIFICATE-----
+MIIG7jCCBNagAwIBAgIBDzANBgkqhkiG9w0BAQsFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
+BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
+MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
+ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
+8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
+zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
+fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
+w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
+G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
+epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
+laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
+QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
+fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
+YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAX8w
+ggF7MB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TAPBgNVHRMBAf8EBTAD
+AQH/MDQGCWCGSAGG+EIBCAQnFiVodHRwOi8vd3d3LmNhY2VydC5vcmcvaW5kZXgu
+cGhwP2lkPTEwMFYGCWCGSAGG+EIBDQRJFkdUbyBnZXQgeW91ciBvd24gY2VydGlm
+aWNhdGUgZm9yIEZSRUUgaGVhZCBvdmVyIHRvIGh0dHA6Ly93d3cuY2FjZXJ0Lm9y
+ZzAxBgNVHR8EKjAoMCagJKAihiBodHRwOi8vY3JsLmNhY2VydC5vcmcvcmV2b2tl
+LmNybDAzBglghkgBhvhCAQQEJhYkVVJJOmh0dHA6Ly9jcmwuY2FjZXJ0Lm9yZy9y
+ZXZva2UuY3JsMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29j
+c3AuY2FjZXJ0Lm9yZzAfBgNVHSMEGDAWgBQWtTIb1Mfz4OaO873SsDrusjkY0TAN
+BgkqhkiG9w0BAQsFAAOCAgEAR5zXs6IX01JTt7Rq3b+bNRUhbO9vGBMggczo7R0q
+Ih1kdhS6WzcrDoO6PkpuRg0L3qM7YQB6pw2V+ubzF7xl4C0HWltfzPTbzAHdJtja
+JQw7QaBlmAYpN2CLB6Jeg8q/1Xpgdw/+IP1GRwdg7xUpReUA482l4MH1kf0W0ad9
+4SuIfNWQHcdLApmno/SUh1bpZyeWrMnlhkGNDKMxCCQXQ360TwFHc8dfEAaq5ry6
+cZzm1oetrkSviE2qofxvv1VFiQ+9TX3/zkECCsUB/EjPM0lxFBmu9T5Ih+Eqns9i
+vmrEIQDv9tNyJHuLsDNqbUBal7OoiPZnXk9LH+qb+pLf1ofv5noy5vX2a5OKebHe
++0Ex/A7e+G/HuOjVNqhZ9j5Nispfq9zNyOHGWD8ofj8DHwB50L1Xh5H+EbIoga/h
+JCQnRtxWkHP699T1JpLFYwapgplivF4TFv4fqp0nHTKC1x9gGrIgvuYJl1txIKmx
+XdfJzgscMzqpabhtHOMXOiwQBpWzyJkofF/w55e0LttZDBkEsilV/vW0CJsPs3eN
+aQF+iMWscGOkgLFlWsAS3HwyiYLNJo26aqyWPaIdc8E4ck7Sk08WrFrHIK3EHr4n
+1FZwmLpFAvucKqgl0hr+2jypyh5puA3KksHF3CsUzjMUvzxMhykh9zrMxQAHLBVr
+Gwc=
+-----END CERTIFICATE-----
diff --git a/www/coap.html.php b/www/coap.html.php
index 61c38c9..152f89f 100644
--- a/www/coap.html.php
+++ b/www/coap.html.php
@@ -55,13 +55,13 @@ table#TAB1 td { border: 0 }
 <tbody>
 <tr>
 <?php
-	echo '    <td border=0 align="left"><font size=-7>'._("CAcert's Root Certificate sha1 fingerprints").'</font></td>', "\n";
+	echo '    <td border=0 align="left"><font size=-7>'._("CAcert's Root Certificate sha256 fingerprints (since 2019)").'</font></td>', "\n";
 ?>
-    <td border=0 align="right"><font size=-7>class 1: 135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33</font></td>
+    <td border=0 align="right"><font size=-7>class 1: 07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5</font></td>
 </tr>
 <tr>
     <td border=0></td>
-    <td border=0 align="right"><font size=-7>class 3: AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE</font></td>
+    <td border=0 align="right"><font size=-7>class 3: F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544</font></td>
 <tr>
 </font>
 </td>
diff --git a/www/coapnew.php b/www/coapnew.php
index 832e397..6027893 100644
--- a/www/coapnew.php
+++ b/www/coapnew.php
@@ -346,6 +346,10 @@ define('ARBIT', WIKI."/ArbitrationForum");
 define('CCA', "CAcertCommunityAgreement"); // default policy to print
 define('POLICY','policy/'); // default polciy doc directory
 define('EXT','.html'); // default polciy doc extention, should be html
+/* finger print CAcert Root Key SHA256 since 2019*/ // should obtain this automatically
+define('CLASS1_SHA256','07ED BD82 4A49 88CF EF42 15DA 20D4 8C2B 41D7 1529 D7C9 00F5 7092 6F27 7CC2 30C5');
+define('CLASS3_SHA256','F687 3D70 D675 96C2 ACBA 3440 1E69 738B 5270 1DD6 AB06 B497 49BC 5515 0936 D544');
+/* finger print CAcert Root Key */  // not to use since 2019
 /* finger print CAcert Root Key */ // should obtain this automatically
 define('CLASS1_SHA1','135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33');
 define('CLASS3_SHA1','AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE');
@@ -935,7 +939,7 @@ class COAPPDF extends TCPDF {
             $this->SetXY($savex,$savey);
 
             // sha1 fingerprint CAcert rootkeys class 1 and class 3
-            $strg = $this->unhtmlentities( _("CAcert's Root Certificate sha1 fingerprints") ) . ", class 1: ". CLASS1_SHA1 . ", class 3: " . CLASS3_SHA1;
+            $strg = $this->unhtmlentities( _("CAcert's Root Certificate sha256 fingerprints") ) . ", class 1: ". CLASS1_SHA256 . ", class 3: " . CLASS3_SHA256;
             $this->Ln(3); $this->SetX($this->lMargin);
             $this->SetFont(FONT,'',F_SIZE * $this->colwidth / ($this->GetStringWidth($strg) +1));
             $this->Cell($this->colwidth,10, $strg,0,0,'C',0,NULL);