fix: remove expired DST Root CA X3

[deepak1556]

Description of Change

Alternative targeted fix for stable branch lines while the boringssl change is explored in main and beta branches.

Refs https://bugs.chromium.org/p/boringssl/issues/detail?id=439#c2

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• relevant documentation is changed or added
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.

Release Notes

Notes: Remove expired DST Root CA X3 from the bundled trust store

[deepak1556]

Failing test are unrelated, merging

[release-clerk]

Release Notes Persisted

Remove expired DST Root CA X3 from the bundled trust store

[wartab]

Would it be possible to make an Electron 14 release with this patch?

Or is the following patch that got reverted sufficient? #31216

[deepak1556]

The fix available via 14.1.0 is sufficient, this just reverts to a less obtrusive fix on the stable release lines. So this will be available on next update to Electron 14, but there should be no behavior difference between the two.

[quanglam2807]

Thanks for the clarification, @deepak1556. I'm currently running 13.5.1 and it seems like the bug is also fixed with #31216. But a user reported error: ERR_CERT_DATE_INVALID. I checked https://bugs.chromium.org/p/boringssl/issues/detail?id=439#c2
and TRUSTED_FIRST can break other scenarios was mentioned. Could it be a degradation caused by #31216 and this fix is actually better?

[deepak1556]

@quanglam2807 can you open an issue with minimal repro, it would help to confirm if there was a regression. If repro is not available, can you collect the network trace by launching the app with --log-net-log=<some-absolute-path>/netlog.json and perform the failing request. The log will be available once the app is quit.

[quanglam2807]

@deed02392 I'm sorry but I couldn't reproduce the bug on my Mac and the user is not technical-savvy so it'd be difficult to ask for the network trace. If I upgrade from electron@13.5.1 to electron@15.1.1 and it works, maybe we can then make the conclusion? Or is anything better I can do?