From 5b38fc4155c659b0bc15320bfa71012e33696980 Mon Sep 17 00:00:00 2001 From: aaron Date: Wed, 21 Oct 2026 13:39:53 +0200 Subject: [PATCH] fix(certificates): temporarily distrust emSign ECC Root CA - G3 Eight eMudhra intermediates chaining to this root were generated with trivially recoverable private keys (Mozilla bug 2083449), so anyone can mint certificates that non-browser clients using the system bundle will accept. Browsers already block them; the system bundle does not until cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Drop this once the flake lock includes that commit. Co-Authored-By: Claude Opus 5.5 --- modules/nixos/certificates.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/nixos/certificates.nix b/modules/nixos/certificates.nix index cc90cb5..79767dc 100644 --- a/modules/nixos/certificates.nix +++ b/modules/nixos/certificates.nix @@ -17,4 +17,9 @@ in security.pki.certificates = [ caddyRootCA # self-signed pki ca for my home-lab ]; + + # Temporary: eMudhra intermediates under this root have recoverable private + # keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once + # nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88). + security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ]; } -- 2.52.0