Repository navigation
fix: update bundled trust store to Google's current root certificates - #2636
Merged
Merged
Conversation
blakeli0
force-pushed
the
fix/update-bundled-truststore
branch
from
October 21, 2026 17:26
3a32c54 to
2c6e494
Compare
GoogleUtils#getCertificateTrustStore falls back to the bundled google.p12 when the JDK cacerts file can't be loaded (for example on Android and in GraalVM native images). The bundle was a 2013 snapshot: 26 of its 71 roots had expired, it still included roots that root programs have since removed or distrusted (such as AAA Certificate Services), and it had no Google Trust Services roots, so Google APIs only validated through cross-certificates that expire on 2028-01-28. Regenerate google.p12 from https://pki.goog/roots.pem, the roots Google publishes for clients connecting to Google services, keeping the same password and PKCS#12 algorithms for Android compatibility. Regenerate google.jks with the same certificates: the library no longer reads it, but some applications load it directly.
blakeli0
force-pushed
the
fix/update-bundled-truststore
branch
from
October 21, 2026 17:39
2c6e494 to
179033d
Compare
whowes
approved these changes
Oct 21, 2026
blakeli0
added a commit
to googleapis/google-api-java-client-services
that referenced
this pull request
Oct 22, 2026
google-api-client 2.9.2 regenerates its bundled trust store from https://pki.goog/roots.pem (googleapis/google-api-java-client#2636), removing expired and distrusted roots such as AAA Certificate Services.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bundled
google.p12is used byGoogleUtils#getCertificateTrustStore()when the JDKcacertsfile can't be loaded, for example on Android or in GraalVM native images. It's a 2013 snapshot:This PR regenerates
google.p12andgoogle.jksfrom https://pki.goog/roots.pem (21 roots, including GTS Root R1–R4). Both files keep their current password.google.p12also keeps its legacy PKCS#12 algorithms so it still loads on Android. The library doesn't readgoogle.jks, but some applications (for example, Elasticsearch) load it directly, so it's regenerated rather than removed.There are no API changes. Behavior is unchanged when the JDK
cacertsfile can be loaded.How the keystores were generated:
The
-J-Dkeystore.pkcs12.legacyflag keeps the legacy PKCS#12 algorithms that older Android versions need. Usekeytoolrather thanopenssl pkcs12 -export: Java ignores certificates without its trusted-certificate attribute, so a file built withopensslloads with no entries.Testing:
google.jksmatchesgoogle.p12.*.googleapis.comendpoints succeed on Java 11 and 26.