aaron/nixconfig
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(certificates): temporarily distrust emSign ECC Root CA - G3 #111

Merged
aaron merged 1 commits from fix/distrust-emudhra-ecc-root into main 2026-10-21 14:02:23 +02:00
Conversation 0 Commits 1 Files Changed 1
+5
aaron commented 2026-10-21 13:57:14 +02:00
Owner
Copy Link
Copy Source

Stopgap for #110.

Eight eMudhra intermediate CAs chaining to emSign ECC Root CA - G3 were generated with trivially recoverable private keys (Mozilla bug 2083449). Browsers already block them, but anything using the system CA bundle (curl, git, nix, Python, …) still trusts them.

The real fix is cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Until it does, this PR distrusts the root via security.pki.caCertificateBlacklist.

Verified: I built krypton's CA bundle. The root is now rejected for serverAuth, only this one certificate differs from the deployed bundle, and the Caddy home-lab CA is unaffected.

Follow-up (tracked in #110): once nixos-unstable contains f903b88, run nix flake update nixpkgs and remove the blacklist line.

Stopgap for #110. Eight eMudhra intermediate CAs chaining to **emSign ECC Root CA - G3** were generated with trivially recoverable private keys ([Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)). Browsers already block them, but anything using the system CA bundle (curl, git, nix, Python, …) still trusts them. The real fix is cacert 3.131.1 ([nixpkgs `f903b88`](https://github.com/NixOS/nixpkgs/commit/f903b88037954e42a165c27b686201c2f242ae28)), which has not reached nixos-unstable yet. Until it does, this PR distrusts the root via `security.pki.caCertificateBlacklist`. **Verified:** I built krypton's CA bundle. The root is now rejected for serverAuth, only this one certificate differs from the deployed bundle, and the Caddy home-lab CA is unaffected. **Follow-up (tracked in #110):** once nixos-unstable contains `f903b88`, run `nix flake update nixpkgs` and remove the blacklist line.
aaron added 1 commit 2026-10-21 13:57:14 +02:00
fix(certificates): temporarily distrust emSign ECC Root CA - G3 5b38fc4155 
Eight eMudhra intermediates chaining to this root were generated with
trivially recoverable private keys (Mozilla bug 2083449), so anyone can
mint certificates that non-browser clients using the system bundle will
accept. Browsers already block them; the system bundle does not until
cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable
yet. Drop this once the flake lock includes that commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aaron merged commit f54798a8be into main 2026-10-21 14:02:23 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aaron (Aaron)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: aaron/nixconfig#111