From 746cd1283e079b93af832d433d6c3afd62dd72d5 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:02 +0200
Subject: [PATCH] ghost-blog: use a CA bundle without the compromised eMudhra
 roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Node uses its built-in roots, so also switch it to OpenSSL's store with --use-openssl-ca.
---
 ghost-blog/ghost-deployment.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/ghost-blog/ghost-deployment.yaml b/ghost-blog/ghost-deployment.yaml
index 26c15db..c7cc01d 100644
--- a/ghost-blog/ghost-deployment.yaml
+++ b/ghost-blog/ghost-deployment.yaml
@@ -37,6 +37,9 @@ spec:
       - name: tmp
         emptyDir:
           sizeLimit: 64Mi
+      - name: patched-ca-bundle
+        configMap:
+          name: patched-ca-bundle
 
       initContainers:
       - name: permissions-fix
@@ -136,6 +139,13 @@ spec:
               key: MYSQL_DATABASE
         - name: url
           value: https://blog.rubenhensen.nl
+        # Node trusts its built-in roots, which still include the ones above
+        # the compromised eMudhra intermediates. Use patched-ca-bundle through
+        # OpenSSL instead until Node ships a fix.
+        - name: NODE_OPTIONS
+          value: --use-openssl-ca
+        - name: SSL_CERT_FILE
+          value: /etc/ssl/certs/ca-certificates.crt
         envFrom:
         - secretRef:
             name: ghost-mail-config
@@ -153,6 +163,9 @@ spec:
         - name: tmp
           mountPath: /tmp
           readOnly: false
+        - name: patched-ca-bundle
+          mountPath: /etc/ssl/certs
+          readOnly: true
         securityContext:
           allowPrivilegeEscalation: false
           runAsNonRoot: true