From 66e738c792fb8af204666329c7e1215f02a54274 Mon Sep 17 00:00:00 2001 From: aaron Date: Sun, 25 Oct 2026 10:49:12 +0100 Subject: [PATCH] fix(certificates): drop temporary emSign ECC Root CA - G3 distrust cacert 3.131.1 no longer ships this root at all, so the blacklist entry added in #111 is redundant. Closes #110 Co-Authored-By: Claude Opus 5.5 --- modules/nixos/certificates.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix index 79767dc..cc90cb5 100644 --- a/modules/nixos/certificates.nix +++ b/modules/nixos/certificates.nix @@ -17,9 +17,4 @@ in security.pki.certificates = [ caddyRootCA # self-signed pki ca for my home-lab ]; - - # Temporary: eMudhra intermediates under this root have recoverable private - # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once - # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88). - security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ]; }