Thawte (erroneously?) removed from certificate bundle

#2442 updated the certificate bundle and appears to have dropped Thawte from the bundle. Thawte still shows up for me both in the Mozilla bundle and the mkcert.org standard bundle. Mozilla appears to have been unchanged recently: https://hg.mozilla.org/releases/mozilla-release/log/a2ffa9047bf4/security/nss/lib/ckfw/builtins/certdata.txt

So I'm not sure how this happened, but it's broken using requests for Rackspace's cloud API, and I'm sure other sites as well.


@Lukasa generated the certificate with mkcert.org if I recall correctly but I'm not sure the list of certificates he used. It seems we just need to add thawte


Actually looks like it's [here](https://github.com/kennethreitz/requests/blob/master/requests/cacert.pem#L1710) but I see that there seem to be other certificate roots [here](https://github.com/Lukasa/requests/commit/b86330d1f15f04e77093800efb8c6bd6909e8c8e#diff-2560f13d524dedb5044eb83d0622174aL28) and [here](https://github.com/Lukasa/requests/commit/b86330d1f15f04e77093800efb8c6bd6909e8c8e#diff-2560f13d524dedb5044eb83d0622174aL55)

```
~/s/requests git:master ❯❯❯ curl -s https://mkcert.org/labels/ | python -m json.tool | ag 'thawte'
        "thawte Primary Root CA",
        "thawte Primary Root CA - G2",
        "thawte Primary Root CA - G3",
```

Shows that mkcert only seems to know about the Thawte root that we are including.


Yeah, I'm seeing three Thawte certificates in our bundle and three Thawte certificates in Mozilla's bundle. Which certificate exactly are you expecting to see, @jimrollenhagen?


Hmm, I just saw Thawte certs being removed in b86330d1f15f04e77093800efb8c6bd6909e8c8e, I missed that we still have some in the bundle. Let me poke some more and loop back around.


So in that commit the following certificates were removed (by label/sha256 fingerprint):
- GTE CyberTrust Global Root / `a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36`
- Thawte Server CA / `b4:41:0b:73:e2:e6:ea:ca:47:fb:c4:2f:8f:a4:01:8a:f4:38:1d:c5:4c:fa:a8:44:50:46:1e:ed:09:45:4d:e9`
- Thawte Premium Server CA / `ab:70:36:36:5c:71:54:aa:29:c2:c2:9f:5d:41:91:16:3b:16:2a:22:25:01:13:57:d5:6d:07:ff:a7:bc:1f:72`
- Verisign Class 3 Public Primary Certification Authority / `e7:68:56:34:ef:ac:f6:9a:ce:93:9a:6b:25:5b:7b:4f:ab:ef:42:93:5b:50:a2:65:ac:b5:cb:60:27:e4:4e:70`
- Verisign Class 3 Public Primary Certification Authority - G2 / `83:ce:3c:12:29:68:8a:59:3d:48:5f:81:97:3c:0f:91:95:43:1e:da:37:cc:5e:36:43:0e:79:c7:a8:88:63:8b`
- ValiCert Class 1 VA / `f4:c1:49:55:1a:30:13:a3:5b:c7:bf:fe:17:a7:f3:44:9b:c1:ab:5b:5a:0a:e7:4b:06:c2:3b:90:00:4c:01:04`
- ValiCert Class 2 VA / `58:d0:17:27:9c:d4:dc:63:ab:dd:b1:96:a6:c9:90:6c:30:c4:e0:87:83:ea:e8:c1:60:99:54:d6:93:55:59:6b`
- RSA Root Certificate 1 / `bc:23:f9:8a:31:3c:b9:2d:e3:bb:fc:3a:5a:9f:44:61:ac:39:49:4c:4a:e1:5a:9e:9d:f1:31:e9:9b:73:01:9a`
- Entrust.net Secure Server CA / `62:f2:40:27:8c:56:4c:4d:d8:bf:7d:9d:4f:6f:36:6e:a8:94:d2:2f:5f:34:d9:89:a9:83:ac:ec:2f:ff:ed:50`
- Equifax Secure eBusiness CA 1 / `cf:56:ff:46:a4:a1:86:10:9d:d9:65:84:b5:ee:b5:8a:51:0c:42:75:b0:e5:f9:4f:40:bb:ae:86:5e:19:f6:73`
- America Online Root Certification Authority 1 / `77:40:73:12:c6:3a:15:3d:5b:c0:0b:4e:51:75:9c:df:da:c2:37:dc:2a:33:b6:79:46:e9:8e:9b:fa:68:0a:e3`
- America Online Root Certification Authority 2 / `7d:3b:46:5a:60:14:e5:26:c0:af:fc:ee:21:27:d2:31:17:27:ad:81:1c:26:84:2d:00:6a:f3:73:06:cc:80:bd`
- TDC Internet Root CA / `48:98:c6:88:8c:0c:ff:b0:d3:e3:1a:ca:8a:37:d4:e3:51:5f:f7:46:d0:26:35:d8:66:46:cf:a0:a3:18:5a:e7`
- NetLock Business (Class B) Root / `39:df:7b:68:2b:7b:93:8f:84:71:54:81:cc:de:8d:60:d8:f2:2e:c5:98:87:7d:0a:aa:c1:2b:59:18:2b:03:12`
- NetLock Express (Class C) Root / `0b:5e:ed:4e:84:64:03:cf:55:e0:65:84:84:40:ed:2a:82:75:8b:f5:b9:aa:1f:25:3d:46:13:cf:a0:80:ff:3f`
- Firmaprofesional Root CA / `c1:cf:0b:52:09:64:35:e3:f1:b7:1d:aa:ec:45:5a:23:11:c8:40:4f:55:83:a9:e2:13:c6:9d:85:7d:94:33:05`
- AC Ra\xC3\xADz Certic\xC3\xA1mara S.A. / `a6:c5:1e:0d:a5:ca:0a:93:09:d2:e4:c0:e4:0c:2a:f9:10:7a:ae:82:03:85:7f:e1:98:e3:e7:69:e3:43:08:5c`
- Verisign Class 3 Public Primary Certification Authority / `a4:b6:b3:99:6f:c2:f3:06:b3:fd:86:81:bd:63:41:3d:8c:50:09:cc:4f:a3:29:c2:cc:f0:e2:fa:1b:14:03:05`

There were others that were added too. Proposal: We should revert (at least some of) the deletions that took place in b86330d after confirming that none of them were intentionally removed/blacklisted from Mozilla's bundle (we don't want to add back compromised CAs).


I now believe this is a manifestation of #2455: closing to focus the discussion there.