fix(certificates): temporarily distrust emSign ECC Root CA - G3

Eight eMudhra intermediates chaining to this root were generated with trivially recoverable private keys (Mozilla bug 2083449), so anyone can mint certificates that non-browser clients using the system bundle will accept. Browsers already block them; the system bundle does not until cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Drop this once the flake lock includes that commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(tailscale): open Tailscale's WireGuard port in the firewall' (#109 ) from fix/tailscale-open-firewall into main
2026-10-21 13:39:53 +02:00 · 2026-10-20 12:50:24 +02:00
1 changed files with 5 additions and 0 deletions
@@ -17,4 +17,9 @@ in
  security.pki.certificates = [
    caddyRootCA # self-signed pki ca for my home-lab
  ];
  # Temporary: eMudhra intermediates under this root have recoverable private
  # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
  # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
  security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
 }