aaronandClaude Opus 5.5
5b38fc4155
Eight eMudhra intermediates chaining to this root were generated with trivially recoverable private keys (Mozilla bug 2083449), so anyone can mint certificates that non-browser clients using the system bundle will accept. Browsers already block them; the system bundle does not until cacert 3.131.1 (nixpkgs f903b88), which has not reached nixos-unstable yet. Drop this once the flake lock includes that commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.1 KiB
Nix
26 lines
1.1 KiB
Nix
let
|
|
caddyRootCA = ''
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBozCCAUmgAwIBAgIQf2N1DGp2HVOoPaGuGDEnwjAKBggqhkjOPQQDAjAwMS4w
|
|
LAYDVQQDEyVDYWRkeSBMb2NhbCBBdXRob3JpdHkgLSAyMDI1IEVDQyBSb290MB4X
|
|
DTI1MTEwNjE5NDA1OFoXDTM1MDkxNTE5NDA1OFowMDEuMCwGA1UEAxMlQ2FkZHkg
|
|
TG9jYWwgQXV0aG9yaXR5IC0gMjAyNSBFQ0MgUm9vdDBZMBMGByqGSM49AgEGCCqG
|
|
SM49AwEHA0IABGR9mSgKCSjvcv7LvvIcO84Wpf/KtC/aexT5shSKXd1R97kIyMI5
|
|
SUYz0MzbRZHJ4QMpIeALirOK9Eoy2zht0dKjRTBDMA4GA1UdDwEB/wQEAwIBBjAS
|
|
BgNVHRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRHKfIfJrrA2DACFrunVSmdnJHO
|
|
1zAKBggqhkjOPQQDAgNIADBFAiAoqc0+cHeq/8SQN16CKjVvXpZuMkg7NLDoWYMw
|
|
KgmzowIhAJlkxzBdVngwnJu8uPrVizTGF6XtmUHdJ0NDeccEqUCr
|
|
-----END CERTIFICATE-----
|
|
'';
|
|
in
|
|
{
|
|
security.pki.certificates = [
|
|
caddyRootCA # self-signed pki ca for my home-lab
|
|
];
|
|
|
|
# Temporary: eMudhra intermediates under this root have recoverable private
|
|
# keys (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449). Remove once
|
|
# nixos-unstable ships cacert >= 3.131.1 (nixpkgs f903b88).
|
|
security.pki.caCertificateBlacklist = [ "emSign ECC Root CA - G3" ];
|
|
}
|