mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
bb7e2f2bac
The private keys of eight eMudhra intermediates are recoverable (https://emudhra.we-have-a-problem.com). node001 runs NixOS 25.11 from March with nss-cacert 3.121, and curl there still accepted a chain via emSign ECC Root CA - G3. Blacklist that root and Comodo AAA Services root until nixpkgs ships NSS 3.131.1. Everything node001 talks to chains to ISRG Root X1. Already deployed with ./cli update node001, and Gatus, ntfy and Stalwart were restarted so they reload the trust store.