Merge pull request 'fix(certificates): temporarily distrust emSign ECC Root CA - G3' (#111 ) from fix/distrust-emudhra-ecc-root into main

Reviewed-on: #111
fix(certificates): temporarily distrust emSign ECC Root CA - G3
2026-10-21 14:02:23 +02:00 · 2026-10-21 13:39:53 +02:00
1 changed files with 5 additions and 0 deletions
@@ -17,4 +17,9 @@ in
  security.pki.certificates = [
    caddyRootCA # self-signed pki ca for my home-lab
  ];
+
+  # Temporary: eMudhra intermediates under this root have recoverable private
+  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
+  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
+  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }