From 39e04039c93b95b347d336eb93c3e4346613a50e Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 3 Jan 2014 13:01:28 +0000
Subject: [PATCH] Remove trust root: VeriSign Class 3 Public Primary CA
 (generation 3)

---
 build/check_embedded.pl |  1 -
 mdx/uk/trust-roots.xml  | 66 -----------------------------------------
 2 files changed, 67 deletions(-)

diff --git a/build/check_embedded.pl b/build/check_embedded.pl
index 0b1a6c44..3796de88 100755
--- a/build/check_embedded.pl
+++ b/build/check_embedded.pl
@@ -45,7 +45,6 @@
 $issuerMark{'AddTrust External CA Root'} = 'R';
 $issuerMark{'UTN-USERFirst-Hardware'} = 'i';
 $issuerMark{'TERENA SSL CA'} = 'i';
-$issuerMark{'VeriSign Class 3 Public Primary Certification Authority - G3'} = 'R'; # root alone
 $issuerMark{'GlobalSign Root CA'} = 'R';
 $issuerMark{'GlobalSign Organization Validation CA'} = 'i';
 $issuerMark{'GlobalSign Primary Secure Server CA'} = 'i';
diff --git a/mdx/uk/trust-roots.xml b/mdx/uk/trust-roots.xml
index c12c6567..026779a9 100644
--- a/mdx/uk/trust-roots.xml
+++ b/mdx/uk/trust-roots.xml
@@ -205,72 +205,6 @@
 		        </ds:X509Data>
 		    </ds:KeyInfo>
 		    
-		    <!--
-		        *******************************************************
-		        ***                                                 ***
-		        ***   V E R I S I G N   C L A S S   3   G E N   3   ***
-		        ***                                                 ***
-		        *******************************************************
-		        
-		        The following root certificate partially supports PKIX use of
-		        certain commercial end entity certificates issued by VeriSign.
-		        
-		        Note that no intermediate CA certificates associated with this
-		        root have ever been included in the UK federation trust fabric.
-		    -->
-		    
-			<ds:KeyInfo>
-				<!--
-				
-					VeriSign Class 3 Public Primary CA (generation 3)
-					
-					There are various versions ("generations") of the VeriSign Class3
-					Public Primary CA certificate.  This is the third generation root.
-					
-					Subject and Issuer:
-					    C=US
-					    O=VeriSign, Inc.
-					    OU=VeriSign Trust Network
-					    OU=(c) 1999 VeriSign, Inc. - For authorized use only
-					    CN=VeriSign Class 3 Public Primary Certification Authority - G3
-					
-					This is used to sign a number of intermediate CA certificates,
-					according to the VeriSign Trust Network CA Hierarchy diagram dated 30-Apr-2009.
-					
-					One intermediate CA below the root, so requires a verification depth of at least 2.
-
-					Validity
-						Not Before: Oct  1 00:00:00 1999 GMT
-						Not After : Jul 16 23:59:59 2036 GMT
-
-				-->
-				<ds:X509Data>
-					<ds:X509Certificate>MIIEGjCCAwICEQCbfgZJoz5iudXukEhxKe9XMA0GCSqGSIb3DQEBBQUAMIHKMQsw
-CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl
-cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
-LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlT
-aWduIENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3Jp
-dHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYD
-VQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
-aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJ
-bmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWdu
-IENsYXNzIDMgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg
-LSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMu6nFL8eB8aHm8b
-N3O9+MlrlBIwT/A2R/XQkQr1F8ilYcEWQE37imGQ5XYgwREGfassbqb1EUGO+i2t
-KmFZpGcmTNDovFJbcCAEWNF6yaRpvIMXZK0Fi7zQWM6NjPXr8EJJC52XJ2cybuGu
-kxUccLwgTS8Y3pKI6GyFVxEa6X7jJhFUokWWVYPKMIno3Nij7SqAP395ZVc+FSBm
-CC+Vk7+qRy+oRpfwEuL+wgorUeZ25rdGt+INpsyow0xZVYnm6FNcHOqd8GIWC6fJ
-Xwzw3sJ2zq/3avL6QaaiMxTJ5Xpj055iN9WFZZ4O5lMkdBteHRJTW8cs54NJOxWu
-imi5V5cCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAERSWwauSCPc/L8my/uRan2Te
-2yFPhpk0djZX3dAVL8WtfxUfN2JzPtTnX84XA9s1+ivbrmAJXx5fj267Cz3qWhMe
-DGBvtcC1IyIuBwvLqXTLR7sdwdela8wv0kL9Sd2nic9TutoAWii/gt/4uhMdUIaC
-/Y4wjylGsB49Ndo4YhYYSq3mtlFs3q9i6wHQHiT+eo8SGhJouPtmmRQURVyu565p
-F4ErWjfJXir0xuKhXFSbplQAz/DxwceYMBo7Nhbbo27q/a2ywtrvAkcTisDxszGt
-TxzhT5yvDwyd93gN2PQ1VoDat20Xj50egWTh/sVFuq1ruQp6Tk9LhO5L8X3dEQ==
-</ds:X509Certificate>
-				</ds:X509Data>
-			</ds:KeyInfo>
-
 		    <!--
 		        *******************************
 		        ***                         ***