From 0577ab12a1c919687727b916e33e1c983e70f00a Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Tue, 20 Oct 2026 20:57:32 -0700
Subject: [PATCH] pki: distrust roots cross-signing compromised eMudhra
 intermediates

Private keys for eight eMudhra intermediate CAs were compromised in
Oct 2026. Blacklist emSign ECC Root CA - G3 and Comodo AAA Services root,
matching the upstream NSS 3.131.1 fix, until nixos-26.05 ships it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 configuration.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index 657b5ee..aa74a6c 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -68,6 +68,14 @@
     }];
   };
 
+  # eMudhra intermediate CA key compromise (Oct 2026): distrust the two roots
+  # that cross-sign the compromised intermediates, matching the upstream NSS
+  # 3.131.1 fix. Drop this once nixos-26.05 ships cacert >= 3.131.1.
+  security.pki.caCertificateBlacklist = [
+    "emSign ECC Root CA - G3"
+    "Comodo AAA Services root"
+  ];
+
   environment.variables = {
     SBCL_HOME = "/run/current-system/sw/lib/sbcl";
   };