From: Florian Larysch <fl@n621.de>
To: buildroot@buildroot.org
Cc: Martin Bark <martin@barkynet.com>, Florian Larysch <fl@n621.de>
Subject: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates
Date: Tue, 20 Oct 2026 16:46:55 +0200 [thread overview]
Message-ID: <20261020144902.10111-2-fl@n621.de> (raw)
Remove root certificates chaining to compromised eMudhra intermediate CA
certs as suggested in [1].
See [2] for more authoritative details.
[1] https://emudhra.we-have-a-problem.com/
[2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
Signed-off-by: Florian Larysch <fl@n621.de>
---
Note that this is a fairly drastic way to resolve this that might affect
a lot of legitimate certificates too depending on your application, so
I'm not sure this is a thing that should actually be merged.
Just putting this here for reference after discussing with Thomas on
IRC.
---
.../ca-certificates/0002-remove-eMudhra-parents.patch | 11 +++++++++++
1 file changed, 11 insertions(+)
create mode 100644 package/ca-certificates/0002-remove-eMudhra-parents.patch
diff --git a/package/ca-certificates/0002-remove-eMudhra-parents.patch b/package/ca-certificates/0002-remove-eMudhra-parents.patch
new file mode 100644
index 0000000000..46ff520f56
--- /dev/null
+++ b/package/ca-certificates/0002-remove-eMudhra-parents.patch
@@ -0,0 +1,11 @@
+diff -Nru ca-certificates/mozilla/blacklist.txt patched/mozilla/blacklist.txt
+--- ca-certificates/mozilla/blacklist.txt 2026-02-23 16:32:21.000000000 +0100
++++ patched/mozilla/blacklist.txt 2026-10-20 16:21:52.412423854 +0200
+@@ -2,5 +2,7 @@
+
+ # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
+ "Explicitly Distrust DigiNotar Root CA"
++"emSign ECC Root CA - G3"
++"Comodo AAA Services root"
+
+ # Expired CAs
--
2.56.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next reply other threads:[~2026-10-20 14:49 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 14:46 Florian Larysch [this message]
2026-10-21 5:22 ` [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates yann.morin
2026-10-21 13:34 ` Florian Larysch
2026-10-21 17:58 ` Fiona Klute via buildroot
2026-10-21 19:21 ` Thomas Petazzoni via buildroot
2026-10-21 22:34 ` Florian Larysch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020144902.10111-2-fl@n621.de \
--to=fl@n621.de \
--cc=buildroot@buildroot.org \
--cc=martin@barkynet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox