From: Florian Larysch <fl@n621.de>
To: buildroot@buildroot.org
Cc: Martin Bark <martin@barkynet.com>, Florian Larysch <fl@n621.de>
Subject: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates
Date: Tue, 20 Oct 2026 16:46:55 +0200 [thread overview]
Message-ID: <20261020144902.10111-2-fl@n621.de> (raw)
Remove root certificates chaining to compromised eMudhra intermediate CA
certs as suggested in [1].
See [2] for more authoritative details.
[1] https://emudhra.we-have-a-problem.com/
[2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
Signed-off-by: Florian Larysch <fl@n621.de>
---
Note that this is a fairly drastic way to resolve this that might affect
a lot of legitimate certificates too depending on your application, so
I'm not sure this is a thing that should actually be merged.
Just putting this here for reference after discussing with Thomas on
IRC.
---
.../ca-certificates/0002-remove-eMudhra-parents.patch | 11 +++++++++++
1 file changed, 11 insertions(+)
create mode 100644 package/ca-certificates/0002-remove-eMudhra-parents.patch
diff --git a/package/ca-certificates/0002-remove-eMudhra-parents.patch b/package/ca-certificates/0002-remove-eMudhra-parents.patch
new file mode 100644
index 0000000000..46ff520f56
--- /dev/null
+++ b/package/ca-certificates/0002-remove-eMudhra-parents.patch
@@ -0,0 +1,11 @@
+diff -Nru ca-certificates/mozilla/blacklist.txt patched/mozilla/blacklist.txt
+--- ca-certificates/mozilla/blacklist.txt 2026-02-23 16:32:21.000000000 +0100
++++ patched/mozilla/blacklist.txt 2026-10-20 16:21:52.412423854 +0200
+@@ -2,5 +2,7 @@
+
+ # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
+ "Explicitly Distrust DigiNotar Root CA"
++"emSign ECC Root CA - G3"
++"Comodo AAA Services root"
+
+ # Expired CAs
--
2.56.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next reply other threads:[~2026-10-20 14:49 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 14:46 Florian Larysch [this message]
2026-10-21 5:22 ` [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates yann.morin
2026-10-21 13:34 ` Florian Larysch
2026-10-21 17:58 ` Fiona Klute via buildroot
2026-10-21 19:21 ` Thomas Petazzoni via buildroot
2026-10-21 22:34 ` Florian Larysch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020144902.10111-2-fl@n621.de \
--to=fl@n621.de \
--cc=buildroot@buildroot.org \
--cc=martin@barkynet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.