From 89b37015c677b65905333671dc5a7bb045d49dea Mon Sep 17 00:00:00 2001
From: Jordan Rose <jrose@signal.org>
Date: Wed, 27 Aug 2025 16:48:34 -0700
Subject: [PATCH] Reserve a second sealed sender ServerCertificate ID

---
 .../textsecuregcm/workers/CertificateCommand.java             | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/workers/CertificateCommand.java b/service/src/main/java/org/whispersystems/textsecuregcm/workers/CertificateCommand.java
index cd7acf55a..70c5e1d19 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/workers/CertificateCommand.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/workers/CertificateCommand.java
@@ -22,7 +22,9 @@ import org.whispersystems.textsecuregcm.entities.MessageProtos;
 public class CertificateCommand extends Command {
 
   private static final Set<Integer> RESERVED_CERTIFICATE_IDS = Set.of(
-      0xdeadc357 // Reserved for testing; see https://github.com/signalapp/libsignal-client/pull/118
+    // Reserved for testing in libsignal.
+    0xdeadc357, // "dead cert", one considered revoked
+    0x7357c357  // "test cert", one signed with a testing trust root
   );
 
   public CertificateCommand() {