authentik: mount a CA bundle without the compromised eMudhra roots

Browse Source

Server and worker trusted the leaked eMudhra intermediates through the
Debian bundle (ca-certificates 20250419), Python's ssl module and certifi
2026.01.04. Mount patched-ca-bundle over /etc/ssl/certs and point
SSL_CERT_FILE and REQUESTS_CA_BUNDLE at it until an authentik image ships
a fixed bundle and certifi.

...

This commit is contained in:

Ruben Hensen committed 2026-10-21 12:09:41 +02:00

1 parent a507282103

commit 25a6bf3a05

2 files changed

+3091

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

authentik/patched-ca-bundle.yaml

+3072

File diff suppressed because it is too large. Load diff