From ea86611deb254a7f75277e47f2cf4f0cf16e4909 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 22 Oct 2026 09:13:02 +0200
Subject: [PATCH] cert-manager: mount a CA bundle without the compromised
 eMudhra roots

Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Only the controller, which talks ACME to Let's Encrypt.
---
 apps/templates/cert-manager-helm.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/apps/templates/cert-manager-helm.yaml b/apps/templates/cert-manager-helm.yaml
index f7894ad..d639d49 100644
--- a/apps/templates/cert-manager-helm.yaml
+++ b/apps/templates/cert-manager-helm.yaml
@@ -18,6 +18,17 @@ spec:
       parameters:
         - name: crds.enabled
           value: 'true'
+      # The controller talks ACME to Let's Encrypt. Give it a trust store
+      # without the compromised eMudhra intermediates, see ca-bundle/.
+      values: |
+        volumes:
+          - name: patched-ca-bundle
+            configMap:
+              name: patched-ca-bundle
+        volumeMounts:
+          - name: patched-ca-bundle
+            mountPath: /etc/ssl/certs
+            readOnly: true
   syncPolicy:
     syncOptions:
     - CreateNamespace=true