KarpelesLab · MagicalTux · Jun 5, 2026 · Jun 5, 2026
diff --git a/examples/cacrt-tool.rs b/examples/cacrt-tool.rs
@@ -242,9 +242,26 @@ fn cmd_verify() -> Result<(), String> {
             problems += 1;
             eprintln!("FAIL {}: {reason}", path.display());
         }
-        if subject_hash(&der).is_err() {
-            problems += 1;
-            eprintln!("FAIL {}: cannot compute subject hash", path.display());
+        match subject_hash(&der) {
+            Err(_) => {
+                problems += 1;
+                eprintln!("FAIL {}: cannot compute subject hash", path.display());
+            }
+            // Keep the informational `# OpenSSL subject hash:` header honest: a
+            // stale header (e.g. left over from an older hash implementation) is
+            // harmless to the build but misleads anyone reading the file by hand.
+            Ok(hash) => {
+                let text = std::fs::read_to_string(&path).map_err(|e| e.to_string())?;
+                if let Some(declared) = parse_header_hash(&text) {
+                    if declared != hash {
+                        problems += 1;
+                        eprintln!(
+                            "FAIL {}: header subject hash {declared:08x} != computed {hash:08x}",
+                            path.display()
+                        );
+                    }
+                }
+            }
         }
     }
     if problems > 0 {
@@ -254,6 +271,15 @@ fn cmd_verify() -> Result<(), String> {
     Ok(())
 }
 
+/// Parse the `# OpenSSL subject hash: <8 hex>` header written by `render_pem`.
+/// Returns `None` if absent or malformed (the header is informational).
+fn parse_header_hash(text: &str) -> Option<u32> {
+    let line = text
+        .lines()
+        .find_map(|l| l.trim_start().strip_prefix("# OpenSSL subject hash:"))?;
+    u32::from_str_radix(line.trim(), 16).ok()
+}
+
 // ---------------------------------------------------------------------------
 // diff
 // ---------------------------------------------------------------------------

diff --git a/roots/ACCV/ACCVRAIZ1.pem b/roots/ACCV/ACCVRAIZ1.pem
@@ -1,5 +1,5 @@
 # Label: ACCVRAIZ1
-# OpenSSL subject hash: fc55b1d6
+# OpenSSL subject hash: a94d09e5
 # SHA1 fingerprint: 93:05:7A:88:15:C6:4F:CE:88:2F:FA:91:16:52:28:78:BC:53:64:17
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/ANF/ANF_Secure_Server_Root_CA.pem b/roots/ANF/ANF_Secure_Server_Root_CA.pem
@@ -1,5 +1,5 @@
 # Label: ANF Secure Server Root CA
-# OpenSSL subject hash: cfeea04b
+# OpenSSL subject hash: b433981b
 # SHA1 fingerprint: 5B:6E:68:D0:CC:15:B6:A0:5F:1E:C1:5F:AE:02:FC:6B:2F:5D:6F:74
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Actalis/Actalis_Authentication_Root_CA.pem b/roots/Actalis/Actalis_Authentication_Root_CA.pem
@@ -1,5 +1,5 @@
 # Label: Actalis Authentication Root CA
-# OpenSSL subject hash: db47b359
+# OpenSSL subject hash: 930ac5d2
 # SHA1 fingerprint: F3:73:B3:87:06:5A:28:84:8A:F2:F3:4A:CE:19:2B:DD:C7:8E:9C:AC
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Amazon/Amazon_Root_CA_1.pem b/roots/Amazon/Amazon_Root_CA_1.pem
@@ -1,5 +1,5 @@
 # Label: Amazon Root CA 1
-# OpenSSL subject hash: 172fdc4e
+# OpenSSL subject hash: ce5e74ef
 # SHA1 fingerprint: 8D:A7:F9:65:EC:5E:FC:37:91:0F:1C:6E:59:FD:C1:CC:6A:6E:DE:16
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Amazon/Amazon_Root_CA_2.pem b/roots/Amazon/Amazon_Root_CA_2.pem
@@ -1,5 +1,5 @@
 # Label: Amazon Root CA 2
-# OpenSSL subject hash: 7d79dbdf
+# OpenSSL subject hash: 6d41d539
 # SHA1 fingerprint: 5A:8C:EF:45:D7:A6:98:59:76:7A:8C:8B:44:96:B5:78:CF:47:4B:1A
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Amazon/Amazon_Root_CA_3.pem b/roots/Amazon/Amazon_Root_CA_3.pem
@@ -1,5 +1,5 @@
 # Label: Amazon Root CA 3
-# OpenSSL subject hash: 1ed28a6e
+# OpenSSL subject hash: 8cb5ee0f
 # SHA1 fingerprint: 0D:44:DD:8C:3C:8C:1A:1A:58:75:64:81:E9:0F:2E:2A:FF:B3:D2:6E
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Amazon/Amazon_Root_CA_4.pem b/roots/Amazon/Amazon_Root_CA_4.pem
@@ -1,5 +1,5 @@
 # Label: Amazon Root CA 4
-# OpenSSL subject hash: 1e99976d
+# OpenSSL subject hash: de6d66f3
 # SHA1 fingerprint: F6:10:84:07:D6:F8:BB:67:98:0C:C2:E2:44:C2:EB:AE:1C:EF:63:BE
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Atos/Atos_TrustedRoot_2011.pem b/roots/Atos/Atos_TrustedRoot_2011.pem
@@ -1,5 +1,5 @@
 # Label: Atos TrustedRoot 2011
-# OpenSSL subject hash: fa7642af
+# OpenSSL subject hash: e36a6752
 # SHA1 fingerprint: 2B:B1:F5:3E:55:0C:1D:C5:F1:D4:E6:B7:6A:46:4B:55:06:02:AC:21
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Atos/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.pem b/roots/Atos/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.pem
@@ -1,5 +1,5 @@
 # Label: Atos TrustedRoot Root CA ECC TLS 2021
-# OpenSSL subject hash: 139b2cad
+# OpenSSL subject hash: fb717492
 # SHA1 fingerprint: 9E:BC:75:10:42:B3:02:F3:81:F4:F7:30:62:D4:8F:C3:A7:51:B2:DD
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Atos/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem b/roots/Atos/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem
@@ -1,5 +1,5 @@
 # Label: Atos TrustedRoot Root CA RSA TLS 2021
-# OpenSSL subject hash: d35fc52c
+# OpenSSL subject hash: 9b46e03d
 # SHA1 fingerprint: 18:52:3B:0D:06:37:E4:D6:3A:DF:23:E4:98:FB:5B:16:FB:86:74:48
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/BJCA/BJCA_Global_Root_CA1.pem b/roots/BJCA/BJCA_Global_Root_CA1.pem
@@ -1,5 +1,5 @@
 # Label: BJCA Global Root CA1
-# OpenSSL subject hash: 1eed3112
+# OpenSSL subject hash: 0179095f
 # SHA1 fingerprint: D5:EC:8D:7B:4C:BA:79:F4:E7:E8:CB:9D:6B:AE:77:83:10:03:21:6A
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/BJCA/BJCA_Global_Root_CA2.pem b/roots/BJCA/BJCA_Global_Root_CA2.pem
@@ -1,5 +1,5 @@
 # Label: BJCA Global Root CA2
-# OpenSSL subject hash: 8ebe1cb6
+# OpenSSL subject hash: 3e359ba6
 # SHA1 fingerprint: F4:27:86:EB:6E:B8:6D:88:31:67:02:FB:BA:66:A4:53:00:AA:7A:A6
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/CFCA/CFCA_EV_ROOT.pem b/roots/CFCA/CFCA_EV_ROOT.pem
@@ -1,5 +1,5 @@
 # Label: CFCA EV ROOT
-# OpenSSL subject hash: b7577bdf
+# OpenSSL subject hash: 0b1b94ef
 # SHA1 fingerprint: E2:B8:29:4B:55:84:AB:6B:58:C2:90:46:6C:AC:3F:B8:39:8F:84:83
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certainly/Certainly_Root_E1.pem b/roots/Certainly/Certainly_Root_E1.pem
@@ -1,5 +1,5 @@
 # Label: Certainly Root E1
-# OpenSSL subject hash: 7a558193
+# OpenSSL subject hash: 8508e720
 # SHA1 fingerprint: F9:E1:6D:DC:01:89:CF:D5:82:45:63:3E:C5:37:7D:C2:EB:93:6F:2B
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certainly/Certainly_Root_R1.pem b/roots/Certainly/Certainly_Root_R1.pem
@@ -1,5 +1,5 @@
 # Label: Certainly Root R1
-# OpenSSL subject hash: 49e61277
+# OpenSSL subject hash: 7a780d93
 # SHA1 fingerprint: A0:50:EE:0F:28:71:F4:27:B2:12:6D:6F:50:96:25:BA:CC:86:42:AF
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certigna/Certigna_Root_CA.pem b/roots/Certigna/Certigna_Root_CA.pem
@@ -1,5 +1,5 @@
 # Label: Certigna Root CA
-# OpenSSL subject hash: fa659d48
+# OpenSSL subject hash: f51bb24c
 # SHA1 fingerprint: 2D:0D:52:14:FF:9E:AD:99:24:01:74:20:47:6E:6C:85:27:27:F5:43
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certum/Certum_EC_384_CA.pem b/roots/Certum/Certum_EC_384_CA.pem
@@ -1,5 +1,5 @@
 # Label: Certum EC-384 CA
-# OpenSSL subject hash: 946b74b7
+# OpenSSL subject hash: 9482e63a
 # SHA1 fingerprint: F3:3E:78:3C:AC:DF:F4:A2:CC:AC:67:55:69:56:D7:E5:16:3C:E1:ED
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certum/Certum_Trusted_Network_CA.pem b/roots/Certum/Certum_Trusted_Network_CA.pem
@@ -1,5 +1,5 @@
 # Label: Certum Trusted Network CA
-# OpenSSL subject hash: 7068e428
+# OpenSSL subject hash: 48bec511
 # SHA1 fingerprint: 07:E0:32:E0:20:B7:2C:3F:19:2F:06:28:A2:59:3A:19:A7:0F:06:9E
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certum/Certum_Trusted_Network_CA_2.pem b/roots/Certum/Certum_Trusted_Network_CA_2.pem
@@ -1,5 +1,5 @@
 # Label: Certum Trusted Network CA 2
-# OpenSSL subject hash: 60ab2c3b
+# OpenSSL subject hash: 40193066
 # SHA1 fingerprint: D3:DD:48:3E:2B:BF:4C:05:E8:AF:10:F5:FA:76:26:CF:D3:DC:30:92
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Certum/Certum_Trusted_Root_CA.pem b/roots/Certum/Certum_Trusted_Root_CA.pem
@@ -1,5 +1,5 @@
 # Label: Certum Trusted Root CA
-# OpenSSL subject hash: bbed058a
+# OpenSSL subject hash: e35234b1
 # SHA1 fingerprint: C8:83:44:C0:18:AE:9F:CC:F1:87:B7:8F:22:D1:C5:D7:45:84:BA:E5
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Chunghwa-Telecom/HiPKI_Root_CA_G1.pem b/roots/Chunghwa-Telecom/HiPKI_Root_CA_G1.pem
@@ -1,5 +1,5 @@
 # Label: HiPKI Root CA - G1
-# OpenSSL subject hash: 9c4d6a87
+# OpenSSL subject hash: 90c5a3c8
 # SHA1 fingerprint: 6A:92:E4:A8:EE:1B:EC:96:45:37:E3:29:57:49:CD:96:E3:E5:D2:60
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Cybertrust-Japan/SecureSign_Root_CA12.pem b/roots/Cybertrust-Japan/SecureSign_Root_CA12.pem
@@ -1,5 +1,5 @@
 # Label: SecureSign Root CA12
-# OpenSSL subject hash: 02be9d6d
+# OpenSSL subject hash: 616816f6
 # SHA1 fingerprint: 7A:22:1E:3D:DE:1B:06:AC:9E:C8:47:70:16:8E:3C:E5:F7:6B:06:F4
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Cybertrust-Japan/SecureSign_Root_CA14.pem b/roots/Cybertrust-Japan/SecureSign_Root_CA14.pem
@@ -1,5 +1,5 @@
 # Label: SecureSign Root CA14
-# OpenSSL subject hash: 694d1b27
+# OpenSSL subject hash: 878d9bca
 # SHA1 fingerprint: DD:50:C0:F7:79:B3:64:2E:74:A2:B8:9D:9F:D3:40:DD:BB:F0:F2:4F
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Cybertrust-Japan/SecureSign_Root_CA15.pem b/roots/Cybertrust-Japan/SecureSign_Root_CA15.pem
@@ -1,5 +1,5 @@
 # Label: SecureSign Root CA15
-# OpenSSL subject hash: 2236f8a6
+# OpenSSL subject hash: 6a9bdba3
 # SHA1 fingerprint: CB:BA:83:C8:C1:5A:5D:F1:F9:73:6F:CA:D7:EF:28:13:06:4A:07:7D
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_BR_Root_CA_1_2020.pem b/roots/D-Trust/D_TRUST_BR_Root_CA_1_2020.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST BR Root CA 1 2020
-# OpenSSL subject hash: b1faae74
+# OpenSSL subject hash: 9ef4a08a
 # SHA1 fingerprint: 1F:5B:98:F0:E3:B5:F7:74:3C:ED:E6:B0:36:7D:32:CD:F4:09:41:67
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_BR_Root_CA_2_2023.pem b/roots/D-Trust/D_TRUST_BR_Root_CA_2_2023.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST BR Root CA 2 2023
-# OpenSSL subject hash: 7ea7f1ba
+# OpenSSL subject hash: ffdd40f9
 # SHA1 fingerprint: 2D:B0:70:EE:71:94:AF:69:68:17:DB:79:CE:58:9F:A0:6B:96:F7:87
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_EV_Root_CA_1_2020.pem b/roots/D-Trust/D_TRUST_EV_Root_CA_1_2020.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST EV Root CA 1 2020
-# OpenSSL subject hash: b0146b0c
+# OpenSSL subject hash: 5931b5bc
 # SHA1 fingerprint: 61:DB:8C:21:59:69:03:90:D8:7C:9C:12:86:54:CF:9D:3D:F4:DD:07
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_EV_Root_CA_2_2023.pem b/roots/D-Trust/D_TRUST_EV_Root_CA_2_2023.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST EV Root CA 2 2023
-# OpenSSL subject hash: 592d861a
+# OpenSSL subject hash: a09a51ae
 # SHA1 fingerprint: A5:5B:D8:47:6C:8F:19:F7:4C:F4:6D:6B:B6:C2:79:82:22:DF:54:8B
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_Root_Class_3_CA_2_2009.pem b/roots/D-Trust/D_TRUST_Root_Class_3_CA_2_2009.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST Root Class 3 CA 2 2009
-# OpenSSL subject hash: 5c6929b9
+# OpenSSL subject hash: c28a8a30
 # SHA1 fingerprint: 58:E8:AB:B0:36:15:33:FB:80:F7:9B:1B:6D:29:D3:FF:8D:5F:00:F0
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/D-Trust/D_TRUST_Root_Class_3_CA_2_EV_2009.pem b/roots/D-Trust/D_TRUST_Root_Class_3_CA_2_EV_2009.pem
@@ -1,5 +1,5 @@
 # Label: D-TRUST Root Class 3 CA 2 EV 2009
-# OpenSSL subject hash: 99d8d717
+# OpenSSL subject hash: d4dae3dd
 # SHA1 fingerprint: 96:C9:1B:0B:95:B4:10:98:42:FA:D0:D8:22:79:FE:60:FA:B9:16:83
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_Assured_ID_Root_G2.pem b/roots/DigiCert/DigiCert_Assured_ID_Root_G2.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert Assured ID Root G2
-# OpenSSL subject hash: c213266c
+# OpenSSL subject hash: 9d04f354
 # SHA1 fingerprint: A1:4B:48:D9:43:EE:0A:0E:40:90:4F:3C:E0:A4:C0:91:93:51:5D:3F
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_Assured_ID_Root_G3.pem b/roots/DigiCert/DigiCert_Assured_ID_Root_G3.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert Assured ID Root G3
-# OpenSSL subject hash: 9dee8f0c
+# OpenSSL subject hash: 7f3d5d1d
 # SHA1 fingerprint: F5:17:A2:4F:9A:48:C6:C9:F8:A2:00:26:9F:DC:0F:48:2C:AB:30:89
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_Global_Root_G2.pem b/roots/DigiCert/DigiCert_Global_Root_G2.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert Global Root G2
-# OpenSSL subject hash: 25e51cd1
+# OpenSSL subject hash: 607986c7
 # SHA1 fingerprint: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_Global_Root_G3.pem b/roots/DigiCert/DigiCert_Global_Root_G3.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert Global Root G3
-# OpenSSL subject hash: af3ecf9c
+# OpenSSL subject hash: dd8e9d41
 # SHA1 fingerprint: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_TLS_ECC_P384_Root_G5.pem b/roots/DigiCert/DigiCert_TLS_ECC_P384_Root_G5.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert TLS ECC P384 Root G5
-# OpenSSL subject hash: ed3f0a6b
+# OpenSSL subject hash: 9846683b
 # SHA1 fingerprint: 17:F3:DE:5E:9F:0F:19:E9:8E:F6:1F:32:26:6E:20:C4:07:AE:30:EE
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_TLS_RSA4096_Root_G5.pem b/roots/DigiCert/DigiCert_TLS_RSA4096_Root_G5.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert TLS RSA4096 Root G5
-# OpenSSL subject hash: 994f8dd4
+# OpenSSL subject hash: d52c538d
 # SHA1 fingerprint: A7:88:49:DC:5D:7C:75:8C:8C:DE:39:98:56:B3:AA:D0:B2:A5:71:35
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/DigiCert_Trusted_Root_G4.pem b/roots/DigiCert/DigiCert_Trusted_Root_G4.pem
@@ -1,5 +1,5 @@
 # Label: DigiCert Trusted Root G4
-# OpenSSL subject hash: 870389b7
+# OpenSSL subject hash: 75d1b2ed
 # SHA1 fingerprint: DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/QuoVadis_Root_CA_1_G3.pem b/roots/DigiCert/QuoVadis_Root_CA_1_G3.pem
@@ -1,5 +1,5 @@
 # Label: QuoVadis Root CA 1 G3
-# OpenSSL subject hash: 856c53f0
+# OpenSSL subject hash: 749e9e03
 # SHA1 fingerprint: 1B:8E:EA:57:96:29:1A:C9:39:EA:B8:0A:81:1A:73:73:C0:93:79:67
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/QuoVadis_Root_CA_2_G3.pem b/roots/DigiCert/QuoVadis_Root_CA_2_G3.pem
@@ -1,5 +1,5 @@
 # Label: QuoVadis Root CA 2 G3
-# OpenSSL subject hash: dfb5d9fa
+# OpenSSL subject hash: 064e0aa9
 # SHA1 fingerprint: 09:3C:61:F3:8B:8B:DC:7D:55:DF:75:38:02:05:00:E1:25:F5:C8:36
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/DigiCert/QuoVadis_Root_CA_3_G3.pem b/roots/DigiCert/QuoVadis_Root_CA_3_G3.pem
@@ -1,5 +1,5 @@
 # Label: QuoVadis Root CA 3 G3
-# OpenSSL subject hash: 870d470d
+# OpenSSL subject hash: e18bfb83
 # SHA1 fingerprint: 48:12:BD:92:3C:A8:C4:39:06:E7:30:6D:27:96:E6:A4:CF:22:2E:7D
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Disig/CA_Disig_Root_R2.pem b/roots/Disig/CA_Disig_Root_R2.pem
@@ -1,5 +1,5 @@
 # Label: CA Disig Root R2
-# OpenSSL subject hash: 482d4b7c
+# OpenSSL subject hash: 2ae6433e
 # SHA1 fingerprint: B5:61:EB:EA:A4:DE:E4:25:4B:69:1A:98:A5:57:47:C2:34:C7:D9:71
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/FNMT-RCM/AC_RAIZ_FNMT_RCM.pem b/roots/FNMT-RCM/AC_RAIZ_FNMT_RCM.pem
@@ -1,5 +1,5 @@
 # Label: AC RAIZ FNMT-RCM
-# OpenSSL subject hash: 23495735
+# OpenSSL subject hash: cd8c0d63
 # SHA1 fingerprint: EC:50:35:07:B2:15:C4:95:62:19:E2:A8:9A:5B:42:99:2C:4C:2C:20
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/FNMT-RCM/AC_RAIZ_FNMT_RCM_SERVIDORES_SEGUROS.pem b/roots/FNMT-RCM/AC_RAIZ_FNMT_RCM_SERVIDORES_SEGUROS.pem
@@ -1,5 +1,5 @@
 # Label: AC RAIZ FNMT-RCM SERVIDORES SEGUROS
-# OpenSSL subject hash: c8a54705
+# OpenSSL subject hash: b81b93f0
 # SHA1 fingerprint: 62:FF:D9:9E:C0:65:0D:03:CE:75:93:D2:ED:3F:2D:32:C9:E3:E5:4A
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/Firmaprofesional/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem b/roots/Firmaprofesional/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem
@@ -1,5 +1,5 @@
 # Label: Autoridad de Certificacion Firmaprofesional CIF A62634068
-# OpenSSL subject hash: 3c9c73fc
+# OpenSSL subject hash: 3bde41ac
 # SHA1 fingerprint: 0B:BE:C2:27:22:49:CB:39:AA:DB:35:5C:53:E3:8C:AE:78:FF:B6:FE
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GDCA/GDCA_TrustAUTH_R5_ROOT.pem b/roots/GDCA/GDCA_TrustAUTH_R5_ROOT.pem
@@ -1,5 +1,5 @@
 # Label: GDCA TrustAUTH R5 ROOT
-# OpenSSL subject hash: 56942311
+# OpenSSL subject hash: 0f6fa695
 # SHA1 fingerprint: 0F:36:38:5B:81:1A:25:C3:9B:31:4E:83:CA:E9:34:66:70:CC:74:B4
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GlobalSign/GlobalSign_ECC_Root_CA_R4.pem b/roots/GlobalSign/GlobalSign_ECC_Root_CA_R4.pem
@@ -1,5 +1,5 @@
 # Label: GlobalSign ECC Root CA - R4
-# OpenSSL subject hash: 147da805
+# OpenSSL subject hash: b0e59380
 # SHA1 fingerprint: 6B:A0:B0:98:E1:71:EF:5A:AD:FE:48:15:80:77:10:F4:BD:6F:0B:28
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GlobalSign/GlobalSign_ECC_Root_CA_R5.pem b/roots/GlobalSign/GlobalSign_ECC_Root_CA_R5.pem
@@ -1,5 +1,5 @@
 # Label: GlobalSign ECC Root CA - R5
-# OpenSSL subject hash: 33d15a03
+# OpenSSL subject hash: 1d3472b9
 # SHA1 fingerprint: 1F:24:C6:30:CD:A4:18:EF:20:69:FF:AD:4F:DD:5F:46:3A:1B:69:AA
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GlobalSign/GlobalSign_Root_CA_R3.pem b/roots/GlobalSign/GlobalSign_Root_CA_R3.pem
@@ -1,5 +1,5 @@
 # Label: GlobalSign Root CA - R3
-# OpenSSL subject hash: 7a8c7acc
+# OpenSSL subject hash: 062cdee6
 # SHA1 fingerprint: D6:9B:56:11:48:F0:1C:77:C5:45:78:C1:09:26:DF:5B:85:69:76:AD
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GlobalSign/GlobalSign_Root_CA_R6.pem b/roots/GlobalSign/GlobalSign_Root_CA_R6.pem
@@ -1,5 +1,5 @@
 # Label: GlobalSign Root CA - R6
-# OpenSSL subject hash: fff24c09
+# OpenSSL subject hash: dc4d6a89
 # SHA1 fingerprint: 80:94:64:0E:B5:A7:A1:CA:11:9C:1F:DD:D5:9F:81:02:63:A7:FB:D1
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----

diff --git a/roots/GlobalSign/GlobalSign_Root_E46.pem b/roots/GlobalSign/GlobalSign_Root_E46.pem
@@ -1,5 +1,5 @@
 # Label: GlobalSign Root E46
-# OpenSSL subject hash: 33685712
+# OpenSSL subject hash: feffd413
 # SHA1 fingerprint: 39:B4:6C:D5:FE:80:06:EB:E2:2F:4A:BB:08:33:A0:AF:DB:B9:DD:84
 # Source: Mozilla NSS certdata.txt (CKT_NSS_TRUSTED_DELEGATOR, server auth)
 -----BEGIN CERTIFICATE-----