[GH-ISSUE #1605] Please add ca-netboot-xyz.crt to version management #2072

New issue

Open

opened 2026-03-01 18:38:18 +03:00 by kerem · 0 comments

kerem commented

2026-03-01 18:38:18 +03:00

Owner

Originally created by @zhangyoufu on GitHub (Apr 3, 2025).
Original GitHub issue: https://github.com/netbootxyz/netboot.xyz/issues/1605

Is your feature request related to a problem? Please describe.
The ca-netboot-xyz.crt is the trust anchor for this project. It is resonable to check https://boot.netboot.xyz/sigs/menu.ipxe.sig against this CA cert before chainloading. I am not aware where I can find this CA certificate, except extracting it from .sig files.

Describe the solution you'd like
Add ca-netboot-xyz.crt and codesign.crt into this repo, so that whoever interested in chain of trust could find and consume them more easily.

Describe alternatives you've considered
Something like https://ca.ipxe.org ? netboot.xyz does not cross-sign WebPKI root CAs, so may be too heavy.
But make the CA cert available via http/https URL is still helpful.

Additional context
ca-netboot-xyz.crt is about to expire on Jan 28 16:37:31 2026 GMT. Could you please schedule a rotation and annouce it?

Originally created by @zhangyoufu on GitHub (Apr 3, 2025). Original GitHub issue: https://github.com/netbootxyz/netboot.xyz/issues/1605 **Is your feature request related to a problem? Please describe.** The `ca-netboot-xyz.crt` is the trust anchor for this project. It is resonable to check `https://boot.netboot.xyz/sigs/menu.ipxe.sig` against this CA cert before chainloading. I am not aware where I can find this CA certificate, except extracting it from .sig files. **Describe the solution you'd like** Add `ca-netboot-xyz.crt` and `codesign.crt` into this repo, so that whoever interested in chain of trust could find and consume them more easily. **Describe alternatives you've considered** Something like https://ca.ipxe.org ? netboot.xyz does not cross-sign WebPKI root CAs, so may be too heavy. But make the CA cert available via http/https URL is still helpful. **Additional context** `ca-netboot-xyz.crt` is about to expire on `Jan 28 16:37:31 2026 GMT`. Could you please schedule a rotation and annouce it?

kerem added the

enhancement

label

2026-03-01 18:38:18 +03:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/netboot.xyz#2072

No description provided.

Rows
Columns