kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pki: distrust roots cross-signing compromised eMudhra intermediates

Browse Source 
Private keys for eight eMudhra intermediate CAs were compromised in
Oct 2026. Blacklist emSign ECC Root CA - G3 and Comodo AAA Services root,
matching the upstream NSS 3.131.1 fix, until nixos-26.05 ships it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
kyle
2026-10-20 20:57:32 -07:00
co-authored by Claude Opus 5.5
parent 91f081399f
commit 0577ab12a1
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configuration.nix
+8
View File
@@ -68,6 +68,14 @@
}]; }];
}; };
# eMudhra intermediate CA key compromise (Oct 2026): distrust the two roots
# that cross-sign the compromised intermediates, matching the upstream NSS
# 3.131.1 fix. Drop this once nixos-26.05 ships cacert >= 3.131.1.
security.pki.caCertificateBlacklist = [
"emSign ECC Root CA - G3"
"Comodo AAA Services root"
];
environment.variables = { environment.variables = {
SBCL_HOME = "/run/current-system/sw/lib/sbcl"; SBCL_HOME = "/run/current-system/sw/lib/sbcl";
}; };