From 7a89ca25c4dcb6b6d3c0429359fe24944e9d9dd7 Mon Sep 17 00:00:00 2001
From: "K. Isom" <kyle@imap.cc>
Date: Tue, 22 Sep 2026 19:54:39 -0700
Subject: [PATCH] remove the WNTRMUTE CA (MCP teardown)

Kyle 2026-09-22: the shared CA was only for Metacircular services (system
trust store + the MCR podman registry cert). No host should still depend on
it; anything that does should fail loudly rather than keep trusting it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 certs/wntrmute-ca.pem | 19 -------------------
 configuration.nix     |  8 --------
 2 files changed, 27 deletions(-)
 delete mode 100644 certs/wntrmute-ca.pem

diff --git a/certs/wntrmute-ca.pem b/certs/wntrmute-ca.pem
deleted file mode 100644
index 807162f..0000000
--- a/certs/wntrmute-ca.pem
+++ /dev/null
@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIC+zCCAlygAwIBAgIUU/AuAKpyYgObdinoeq/EMxMHJBowCgYIKoZIzj0EAwQw
-gZUxCzAJBgNVBAYTAlVTMQkwBwYDVQQIEwAxCTAHBgNVBAcTADEeMBwGA1UEChMV
-TWV0YWNpcmN1bGFyIER5bmFtaWNzMR8wHQYDVQQLExZDcnlwdG9ncmFwaGljIFNl
-cnZpY2VzMS8wLQYDVQQDEyZNZXRhY2lyY3VsYXIgRHluYW1pY3MgUm9vdCBDZXJ0
-aWZpY2F0ZTAeFw0yNjA0MDMxNTU2NTBaFw00NjAzMjkxNjU2NTBaMIGVMQswCQYD
-VQQGEwJVUzEJMAcGA1UECBMAMQkwBwYDVQQHEwAxHjAcBgNVBAoTFU1ldGFjaXJj
-dWxhciBEeW5hbWljczEfMB0GA1UECxMWQ3J5cHRvZ3JhcGhpYyBTZXJ2aWNlczEv
-MC0GA1UEAxMmTWV0YWNpcmN1bGFyIER5bmFtaWNzIFJvb3QgQ2VydGlmaWNhdGUw
-gZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAHsKdE1YpsMJwZ11lmAaATQpj+98T4o
-ufDP8FncMWNJsr9iB14lwf4qeENuXTGIRcqAjKtIOVZEZeWNfDh38S8a3QERxP7V
-Zb56szR/rBtLJudzT0SHmBKNMWxeeOq7/v4bgt/UjK5GbKxplt6olzknF/CyELnL
-8iWHJ9rJqi9hr/C8z6NFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB
-Af8CAQIwHQYDVR0OBBYEFEVasWoUPP5XmiyY3sAv8XKCyW08MAoGCCqGSM49BAME
-A4GMADCBiAJCAfZCB7vj6LMogrms10YuhexL38UhqFlbXTFmSQXeNLpeEL3VRdkf
-OvHG8ihZb6xka2BD0q6TfHWz3C00nPVRHLr+AkIBnASX1m8TwlFLyEW8BTnKyNi9
-pbpHQehx1/fF85aI3Zkuw4Hx1x9EdeCAARyuHd6E/FumPTli953PUb2FyISXvm4=
------END CERTIFICATE-----
-
diff --git a/configuration.nix b/configuration.nix
index 43731a5..657b5ee 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -151,14 +151,6 @@
   };
   programs.ssh.askPassword =  "ksshaskpass";
 
-  # Trust the WNTRMUTE issuing CA for all Metacircular services.
-  security.pki.certificateFiles = [ ./certs/wntrmute-ca.pem ];
-
-  # Trust the WNTRMUTE CA for podman/skopeo registry connections (MCR).
-  # Podman uses /etc/containers/certs.d/<registry:port>/ca.crt, not the
-  # system CA bundle.
-  environment.etc."containers/certs.d/mcr.svc.mcp.metacircular.net:8443/ca.crt".source = ./certs/wntrmute-ca.pem;
-
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nix.settings.trusted-users = ["kyle"];