From bb7e2f2bacd6a4ca21bb5caea88a51dbc64d4c27 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Wed, 21 Oct 2026 11:49:28 +0200 Subject: [PATCH] node001: distrust the roots above the compromised eMudhra intermediates The private keys of eight eMudhra intermediates are recoverable (https://emudhra.we-have-a-problem.com). node001 runs NixOS 25.11 from March with nss-cacert 3.121, and curl there still accepted a chain via emSign ECC Root CA - G3. Blacklist that root and Comodo AAA Services root until nixpkgs ships NSS 3.131.1. Everything node001 talks to chains to ISRG Root X1. Already deployed with ./cli update node001, and Gatus, ntfy and Stalwart were restarted so they reload the trust store. --- nix-infra-machine/nodes/node001.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix index b0a908c..279a225 100644 --- a/nix-infra-machine/nodes/node001.nix +++ b/nix-infra-machine/nodes/node001.nix @@ -122,6 +122,17 @@ in 80 # HTTP (ACME) ]; + # ────────────────────────────────────────────── + # Trust store + # ────────────────────────────────────────────── + # Distrust the roots above the compromised eMudhra intermediates until + # nixpkgs ships NSS 3.131.1, see https://emudhra.we-have-a-problem.com. + # Everything this box talks to chains to ISRG Root X1. + security.pki.caCertificateBlacklist = [ + "Comodo AAA Services root" + "emSign ECC Root CA - G3" + ]; + # ────────────────────────────────────────────── # ACME / Let's Encrypt # ──────────────────────────────────────────────