The trust anchor

Every token carries its own signing chain (signer → TSA intermediate → root CA), which means a token is self-verifying — but a chain delivered inside the thing it's meant to authenticate isn't itself proof of anything. Pinning the root against a source outside that chain is what closes the loop.

DNS TXT record

CNX publishes the root CA's SPKI pin as a TXT record at _ca.cnx.net.kh, inside a DNSSEC-signed zone:

dig +dnssec TXT _ca.cnx.net.kh

A validating resolver's AD (Authenticated Data) flag on the response confirms the record was DNSSEC-validated. Compare the pin value returned against the root certificate extracted from a token — see Verifying a timestamp for the extraction and comparison commands.

Fetching the intermediate directly

The TSA intermediate CA certificate is also published for direct download:

curl -fsS -o cnx_ica_tsa.crt https://crl.cnx.net.kh/cnx_ica_tsa.crt

Useful when verifying against a known-good certificate file rather than the chain a token delivers — as Verifying report integrity does for DNS's own daily timestamped manifest.

Revocation status for any certificate in the chain is checked against the CRL Distribution Point named in that certificate — CRL files and full installation guidance are published at crl.cnx.net.kh.