Ruben Hensen bb7e2f2bac node001: distrust the roots above the compromised eMudhra intermediates ...

The private keys of eight eMudhra intermediates are recoverable
(https://emudhra.we-have-a-problem.com). node001 runs NixOS 25.11 from
March with nss-cacert 3.121, and curl there still accepted a chain via
emSign ECC Root CA - G3. Blacklist that root and Comodo AAA Services root
until nixpkgs ships NSS 3.131.1. Everything node001 talks to chains to
ISRG Root X1.

Already deployed with ./cli update node001, and Gatus, ntfy and Stalwart
were restarted so they reload the trust store.

2026-10-21 11:49:28 +02:00

..

node001.nix

node001: distrust the roots above the compromised eMudhra intermediates

2026-10-21 11:49:28 +02:00