Update the built-in CRLSet to reflect server side changes last week

This keeps the in-binary CRLSet in-sync with the same set of
explicitly blocked CAs as the Component Updater delivered version.

Bug: 1155981
Change-Id: I49b15a8304bae8b9113bd6ce4f5c0f5f5c1feb7a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2590624
Commit-Queue: Ryan Sleevi <rsleevi@chromium.org>
Commit-Queue: Andrew Whalley <awhalley@chromium.org>
Reviewed-by: David Benjamin <davidben@chromium.org>
Cr-Commit-Position: refs/heads/master@{#836845}

net/cert/cert_verify_proc_blocklist.inc

@@ -145,6 +145,10 @@ static constexpr uint8_t
         {0x87, 0xbf, 0xd8, 0xaf, 0xa3, 0xaf, 0x5b, 0x42, 0x9d, 0x09, 0xa9,
          0xaa, 0x54, 0xee, 0x61, 0x36, 0x4f, 0x5a, 0xe1, 0x11, 0x31, 0xe4,
          0x38, 0xfc, 0x41, 0x09, 0x53, 0x43, 0xcd, 0x16, 0xb1, 0x35},
+        // 61c0fc2e38b5b6f9071b42cee54a9013d858b6697c68b460948551b3249576a1.pem
+        {0x8e, 0x12, 0xd0, 0xcb, 0x3b, 0x7d, 0xf3, 0xea, 0x22, 0x57, 0x57,
+         0x94, 0x89, 0xfd, 0x86, 0x58, 0xc9, 0x56, 0x03, 0xea, 0x6c, 0xf4,
+         0xb7, 0x31, 0x63, 0xa4, 0x1e, 0xb7, 0xb7, 0xe9, 0x3f, 0xee},
         // ddd8ab9178c99cbd9685ea4ae66dc28bfdc9a5a8a166f7f69ad0b5042ad6eb28.pem
         {0x8f, 0x59, 0x1f, 0x7a, 0xa4, 0xdc, 0x3e, 0xfe, 0x94, 0x90, 0xc3,
          0x8a, 0x46, 0x92, 0xc9, 0x01, 0x1e, 0xd1, 0x28, 0xf1, 0xde, 0x59,
@@ -328,6 +332,10 @@ static constexpr uint8_t
 // Hashes of SubjectPublicKeyInfos known to be used for interception by a
 // party other than the device or machine owner.
 static constexpr uint8_t kKnownInterceptionList[][crypto::kSHA256Length] = {
+    // 61c0fc2e38b5b6f9071b42cee54a9013d858b6697c68b460948551b3249576a1.pem
+    {0x8e, 0x12, 0xd0, 0xcb, 0x3b, 0x7d, 0xf3, 0xea, 0x22, 0x57, 0x57, 0x94,
+     0x89, 0xfd, 0x86, 0x58, 0xc9, 0x56, 0x03, 0xea, 0x6c, 0xf4, 0xb7, 0x31,
+     0x63, 0xa4, 0x1e, 0xb7, 0xb7, 0xe9, 0x3f, 0xee},
     // 143315c857a9386973ed16840899c3f96b894a7a612c444efb691f14b0dedd87.pem
     {0xa4, 0xe9, 0xaf, 0x01, 0x41, 0x6e, 0x3a, 0x02, 0x9b, 0x5d, 0x35, 0xe5,
      0xb1, 0x19, 0xde, 0x00, 0xcf, 0xe1, 0x56, 0xc5, 0xcf, 0x95, 0xfc, 0x82,

net/data/ssl/blocklist/61c0fc2e38b5b6f9071b42cee54a9013d858b6697c68b460948551b3249576a1.pem

+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            28:7d:ce:0c:e3:c6:f7:aa:a3:3f:f9:65:e7:6e:a9:8c:82:4a:59:db
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN = Information Security Certification Authority CA, O = ISCA, C = KZ
+        Validity
+            Not Before: Feb 28 04:08:03 2020 GMT
+            Not After : Feb 28 04:08:03 2040 GMT
+        Subject: CN = Information Security Certification Authority CA, O = ISCA, C = KZ
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (4096 bit)
+                Modulus:
+                    00:d9:0f:21:8d:84:fc:f6:26:1f:0f:e8:1d:c6:26:
+                    8a:c3:93:4d:46:ad:2c:7c:a0:e3:d7:10:17:6e:d9:
+                    a1:42:1f:ad:03:90:e1:9d:53:de:86:a1:72:6d:51:
+                    47:64:1b:32:33:09:8b:f5:20:38:06:9f:f6:ca:d1:
+                    3b:0a:69:c3:79:fa:a0:f7:17:d1:b8:d5:f6:a7:a4:
+                    73:52:0a:ec:6a:b6:1a:66:05:e0:68:f5:be:83:f4:
+                    d9:fa:75:d4:b8:68:18:6f:52:34:d5:73:a0:e7:18:
+                    45:af:ae:5c:8c:83:39:0d:7e:4b:f6:da:fd:d2:dc:
+                    d1:13:56:9f:8d:e5:32:bd:3d:00:62:44:a8:75:0c:
+                    c9:9b:07:90:1b:59:f3:59:0f:48:34:47:ff:fe:c9:
+                    90:7f:a0:ef:82:ec:1e:ea:90:99:c9:ef:11:73:06:
+                    dd:1f:c3:fe:d5:4e:6e:1e:d9:88:28:64:96:55:1c:
+                    d7:df:8e:cc:d9:31:91:12:d3:9e:6a:b0:1b:96:c7:
+                    e6:07:be:6d:fd:e2:2b:69:c5:88:3f:4f:a0:a1:04:
+                    9f:f0:ef:78:d8:6a:e1:06:9a:a5:30:76:21:3d:89:
+                    f5:00:b6:29:80:95:53:a7:f9:a5:21:8b:65:1a:d0:
+                    c3:11:eb:bc:2c:76:c5:e7:3d:28:ac:40:4b:a7:ec:
+                    79:68:06:ea:6f:02:14:5d:db:c8:7a:37:a1:15:2e:
+                    ba:f4:cc:5b:da:9e:4a:f5:70:db:15:62:49:e6:8b:
+                    27:ea:90:0a:15:d4:f1:ee:8a:34:1e:f1:90:3f:ab:
+                    d5:11:db:07:93:36:4c:7a:78:63:f1:4e:fa:8c:39:
+                    49:28:b0:19:8b:64:70:c3:75:2c:7f:2d:28:6e:cb:
+                    0f:4f:52:2e:47:c2:4b:8e:aa:55:83:05:f0:28:c6:
+                    9e:2e:c1:9f:e0:65:24:a8:12:cd:b2:3e:f6:7c:d2:
+                    b9:34:60:89:59:e4:60:79:dd:06:fa:3a:9a:3f:6f:
+                    cb:7f:65:02:6c:cc:55:a4:09:a8:01:c8:8d:75:57:
+                    b1:63:dc:ad:1f:ec:0f:5c:b2:ca:6c:63:c8:28:02:
+                    8f:a9:ea:45:de:f8:57:e3:21:e8:2f:64:3e:81:1f:
+                    47:c7:5f:78:af:a8:51:75:f1:d5:00:a9:27:0e:81:
+                    ba:fc:c5:96:cd:aa:84:89:e7:9c:db:ca:17:08:d6:
+                    70:5d:d9:0f:58:9c:ac:b1:ad:44:e9:6d:5f:a2:32:
+                    ff:c6:17:6f:9a:21:d4:15:47:91:de:b8:2c:c6:23:
+                    0e:77:1b:e1:16:eb:0a:6e:e1:e3:62:91:b0:6f:df:
+                    c3:eb:e0:fb:85:44:06:95:26:7f:f1:43:16:de:17:
+                    d6:88:97
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Subject Key Identifier: 
+                A8:7D:CE:0C:E3:C6:F7:AA:A3:3F:F9:65:E7:6E:A9:8C:82:4A:59:DB
+            X509v3 Authority Key Identifier: 
+                keyid:A8:7D:CE:0C:E3:C6:F7:AA:A3:3F:F9:65:E7:6E:A9:8C:82:4A:59:DB
+                DirName:/CN=Information Security Certification Authority CA/O=ISCA/C=KZ
+                serial:28:7D:CE:0C:E3:C6:F7:AA:A3:3F:F9:65:E7:6E:A9:8C:82:4A:59:DB
+
+    Signature Algorithm: sha256WithRSAEncryption
+         3d:d0:c3:61:97:a8:e2:7c:05:4a:9d:37:7f:36:3b:a2:b0:74:
+         39:63:27:35:61:83:19:0e:cd:c0:ba:6a:f7:e2:b2:86:7e:56:
+         18:fb:e1:dc:bb:aa:83:26:43:ce:0c:fb:25:e7:03:b0:42:0b:
+         31:eb:c0:16:2c:0c:a5:30:2d:3f:d6:88:72:9c:8d:3a:05:b6:
+         c7:a3:32:d7:a8:7e:25:3f:33:4f:e5:8e:28:28:23:81:5b:72:
+         5e:70:d2:d9:7c:0b:8e:f0:02:6e:51:da:a0:09:b1:4e:2b:7b:
+         d9:e9:b2:dd:73:f8:05:f8:2e:5e:c1:ba:b8:2c:04:ab:53:bc:
+         0d:cf:b5:9b:51:96:c3:e6:df:37:7b:c5:2d:b1:08:64:5a:c9:
+         b5:dd:32:42:d8:58:34:59:27:a4:7e:03:f8:8a:d4:d3:3b:53:
+         30:1e:11:8a:42:ca:10:d9:a3:f3:82:ac:58:0d:58:3a:6a:c1:
+         54:e2:39:ed:c2:3e:a3:37:68:40:4f:3d:ba:21:4d:b8:cc:57:
+         d1:a3:2f:48:3b:9b:58:f6:04:8f:97:dc:1c:87:bd:31:18:a9:
+         98:9a:df:a1:ce:82:6c:b8:8e:b3:ae:32:c5:9e:4a:a5:f0:fd:
+         18:d3:20:d0:56:b4:ec:d0:0e:79:bb:12:7a:ea:46:98:d1:d6:
+         4a:6e:82:40:33:36:f1:85:48:45:2f:92:3e:e6:a0:aa:3e:fa:
+         2c:47:e3:a8:8e:8d:23:46:7b:13:f1:db:59:2d:42:28:d4:5c:
+         0b:d0:f4:44:ce:f4:4b:09:8e:65:0d:3a:24:dd:fa:24:63:50:
+         49:c0:09:a1:a7:fa:87:7d:f4:2b:20:11:70:43:ab:d1:2d:3f:
+         ae:4a:79:dc:d7:23:2e:4c:4e:ee:9f:31:42:d2:48:b6:90:77:
+         32:e1:55:df:36:ec:f1:33:80:cb:cd:0a:3e:39:a6:a5:62:b1:
+         52:7a:97:e3:7b:dc:9e:f2:2e:bb:6a:e8:07:7a:05:0d:4d:fa:
+         30:b4:30:c8:a2:62:7d:ab:ec:4e:46:b7:9e:23:f8:6c:d0:31:
+         98:07:81:da:07:6e:4e:ad:89:4c:37:51:7a:cc:f0:21:b3:68:
+         72:61:4a:ef:e0:fe:85:24:19:4d:04:0c:a9:5d:b8:78:a0:4c:
+         d0:ae:1c:b5:fd:ba:eb:f0:80:d8:25:1e:17:a3:6d:01:3c:6a:
+         2e:c0:a4:ec:28:12:66:4c:5c:11:fd:07:ea:05:93:05:39:09:
+         23:75:02:83:43:89:02:14:97:3a:92:da:6b:f8:d4:65:3b:ab:
+         68:97:93:7c:ee:ec:30:90:8a:78:18:6f:11:9a:6f:f2:7c:47:
+         f7:bd:69:33:0d:84:3f:16
+-----BEGIN CERTIFICATE-----
+MIIGFDCCA/ygAwIBAgIUKH3ODOPG96qjP/ll526pjIJKWdswDQYJKoZIhvcNAQEL
+BQAwVjE4MDYGA1UEAxMvSW5mb3JtYXRpb24gU2VjdXJpdHkgQ2VydGlmaWNhdGlv
+biBBdXRob3JpdHkgQ0ExDTALBgNVBAoTBElTQ0ExCzAJBgNVBAYTAktaMB4XDTIw
+MDIyODA0MDgwM1oXDTQwMDIyODA0MDgwM1owVjE4MDYGA1UEAxMvSW5mb3JtYXRp
+b24gU2VjdXJpdHkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgQ0ExDTALBgNVBAoT
+BElTQ0ExCzAJBgNVBAYTAktaMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEA2Q8hjYT89iYfD+gdxiaKw5NNRq0sfKDj1xAXbtmhQh+tA5DhnVPehqFybVFH
+ZBsyMwmL9SA4Bp/2ytE7CmnDefqg9xfRuNX2p6RzUgrsarYaZgXgaPW+g/TZ+nXU
+uGgYb1I01XOg5xhFr65cjIM5DX5L9tr90tzRE1afjeUyvT0AYkSodQzJmweQG1nz
+WQ9INEf//smQf6Dvguwe6pCZye8RcwbdH8P+1U5uHtmIKGSWVRzX347M2TGREtOe
+arAblsfmB75t/eIracWIP0+goQSf8O942GrhBpqlMHYhPYn1ALYpgJVTp/mlIYtl
+GtDDEeu8LHbF5z0orEBLp+x5aAbqbwIUXdvIejehFS669Mxb2p5K9XDbFWJJ5osn
+6pAKFdTx7oo0HvGQP6vVEdsHkzZMenhj8U76jDlJKLAZi2Rww3Usfy0obssPT1Iu
+R8JLjqpVgwXwKMaeLsGf4GUkqBLNsj72fNK5NGCJWeRged0G+jqaP2/Lf2UCbMxV
+pAmoAciNdVexY9ytH+wPXLLKbGPIKAKPqepF3vhX4yHoL2Q+gR9Hx194r6hRdfHV
+AKknDoG6/MWWzaqEieec28oXCNZwXdkPWJyssa1E6W1fojL/xhdvmiHUFUeR3rgs
+xiMOdxvhFusKbuHjYpGwb9/D6+D7hUQGlSZ/8UMW3hfWiJcCAwEAAaOB2TCB1jAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUqH3ODOPG
+96qjP/ll526pjIJKWdswgZMGA1UdIwSBizCBiIAUqH3ODOPG96qjP/ll526pjIJK
+WduhWqRYMFYxODA2BgNVBAMTL0luZm9ybWF0aW9uIFNlY3VyaXR5IENlcnRpZmlj
+YXRpb24gQXV0aG9yaXR5IENBMQ0wCwYDVQQKEwRJU0NBMQswCQYDVQQGEwJLWoIU
+KH3ODOPG96qjP/ll526pjIJKWdswDQYJKoZIhvcNAQELBQADggIBAD3Qw2GXqOJ8
+BUqdN382O6KwdDljJzVhgxkOzcC6avfisoZ+Vhj74dy7qoMmQ84M+yXnA7BCCzHr
+wBYsDKUwLT/WiHKcjToFtsejMteofiU/M0/ljigoI4Fbcl5w0tl8C47wAm5R2qAJ
+sU4re9npst1z+AX4Ll7BurgsBKtTvA3PtZtRlsPm3zd7xS2xCGRaybXdMkLYWDRZ
+J6R+A/iK1NM7UzAeEYpCyhDZo/OCrFgNWDpqwVTiOe3CPqM3aEBPPbohTbjMV9Gj
+L0g7m1j2BI+X3ByHvTEYqZia36HOgmy4jrOuMsWeSqXw/RjTINBWtOzQDnm7Enrq
+RpjR1kpugkAzNvGFSEUvkj7moKo++ixH46iOjSNGexPx21ktQijUXAvQ9ETO9EsJ
+jmUNOiTd+iRjUEnACaGn+od99CsgEXBDq9EtP65KedzXIy5MTu6fMULSSLaQdzLh
+Vd827PEzgMvNCj45pqVisVJ6l+N73J7yLrtq6Ad6BQ1N+jC0MMiiYn2r7E5Gt54j
++GzQMZgHgdoHbk6tiUw3UXrM8CGzaHJhSu/g/oUkGU0EDKlduHigTNCuHLX9uuvw
+gNglHhejbQE8ai7ApOwoEmZMXBH9B+oFkwU5CSN1AoNDiQIUlzqS2mv41GU7q2iX
+k3zu7DCQingYbxGab/J8R/e9aTMNhD8W
+-----END CERTIFICATE-----

net/data/ssl/blocklist/README.md

@@ -282,6 +282,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1423400
 For details, see <https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html>
 
   * [00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem](00309c736dd661da6f1eb24173aa849944c168a43a15bffd192eecfdb6f8dbd2.pem)
+  * [61c0fc2e38b5b6f9071b42cee54a9013d858b6697c68b460948551b3249576a1.pem](61c0fc2e38b5b6f9071b42cee54a9013d858b6697c68b460948551b3249576a1.pem)
 
 ### revoked.badssl.com