8303770: Remove Baltimore root certificate expiring in May 2025

[vieiro]

Backport of JDK-8303770 from 11. Mostly clean (certfile location differs from 11).

Test jdk/test/sun/security/lib/cacerts/VerifyCACerts.java passes on RHEL8, x86_64, gcc8.5.0.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• JDK-8303770 needs maintainer approval
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8303770: Remove Baltimore root certificate expiring in May 2025 (Task - P3 - Requested)

Reviewers

• Severin Gehwolf (@jerboaa - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk8u-dev.git pull/650/head:pull/650
$ git checkout pull/650

Update a local copy of the PR:
$ git checkout pull/650
$ git pull https://git.openjdk.org/jdk8u-dev.git pull/650/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 650

View PR using the GUI difftool:
$ git pr show -t 650

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk8u-dev/pull/650.diff

Using Webrev

Link to Webrev Comment

[bridgekeeper]

👋 Welcome back vieiro! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[openjdk]

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

[openjdk]

This backport pull request has now been updated with issue from the original commit.

[mlbridge]

Webrevs

• 02: Full - Incremental (c78e6ee8)
• 01: Full - Incremental (35aec741)
• 00: Full (c78e6ee8)

[vieiro]

Note that some other jdk/security_infra tests have been failing for a while, but are unrelated to the change.

[jerboaa]

Looks good.

[openjdk]

⚠️ @vieiro This change is now ready for you to apply for maintainer approval. This can be done directly in each associated issue or by using the /approval command.

[vieiro]

/approval request please Approve this PR that removes a CA certificate that is expiring in May, it would be great if we could get this merged for the 2025-07 release.

[openjdk]

@vieiro
8303770: The approval request has been created successfully.

[vieiro]

This one moved to openjdk/jdk8u#72

[sendaoYan]

This backport seems backport to jdk8u, but I think jdk8u-dev also need to backported?

[jerboaa]

This backport seems backport to jdk8u, but I think jdk8u-dev also need to backported?

This will get there in time when a merge from jdk8u to jdk8u-dev happens.