[Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Florian Larysch]

Remove root certificates chaining to compromised eMudhra intermediate CA
certs as suggested in [1].

See [2] for more authoritative details.

[1] https://emudhra.we-have-a-problem.com/
[2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE

Signed-off-by: Florian Larysch <fl@n621.de>
---
Note that this is a fairly drastic way to resolve this that might affect
a lot of legitimate certificates too depending on your application, so
I'm not sure this is a thing that should actually be merged.

Just putting this here for reference after discussing with Thomas on
IRC.
---
 .../ca-certificates/0002-remove-eMudhra-parents.patch | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 package/ca-certificates/0002-remove-eMudhra-parents.patch

diff --git a/package/ca-certificates/0002-remove-eMudhra-parents.patch b/package/ca-certificates/0002-remove-eMudhra-parents.patch
new file mode 100644
index 0000000000..46ff520f56
--- /dev/null
+++ b/package/ca-certificates/0002-remove-eMudhra-parents.patch
@@ -0,0 +1,11 @@
+diff -Nru ca-certificates/mozilla/blacklist.txt patched/mozilla/blacklist.txt
+--- ca-certificates/mozilla/blacklist.txt	2026-02-23 16:32:21.000000000 +0100
++++ patched/mozilla/blacklist.txt	2026-10-20 16:21:52.412423854 +0200
+@@ -2,5 +2,7 @@
+ 
+ # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
+ "Explicitly Distrust DigiNotar Root CA"
++"emSign ECC Root CA - G3"
++"Comodo AAA Services root"
+ 
+ # Expired CAs
-- 
2.56.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[yann.morin]

Florian, All,

On 2026-10-20 16:46 +0200, Florian Larysch spake thusly:
> Remove root certificates chaining to compromised eMudhra intermediate CA
> certs as suggested in [1].
> 
> See [2] for more authoritative details.
> 
> [1] https://emudhra.we-have-a-problem.com/
> [2] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE
> 
> Signed-off-by: Florian Larysch <fl@n621.de>

Acked-by: Yann E. MORIN <yann.morin@orange.com>

Note thqt there is a newer version of ca-certs, 20260816, but it is
still too old to have the revoked certs already. There is also
20260816+nmu1 in sid, which supposedly has the leaked certs removed, so
maybe we could also bump to that shortly?

> ---
> Note that this is a fairly drastic way to resolve this that might affect
> a lot of legitimate certificates too depending on your application, so
> I'm not sure this is a thing that should actually be merged.

Well, I better get errors about legitimate certificates, rather than
silently connect to compromised hosts.

And those who have legitimate certs will have to ergenerate new ones
with a trusted CA anyway, since theirs are no longer trusted by major
browsers already anyway.

This also means that the reference image (in support/dockeR/) must also
be regenerated.

Regards,
Yann E. MORIN.

> Just putting this here for reference after discussing with Thomas on
> IRC.
> ---
>  .../ca-certificates/0002-remove-eMudhra-parents.patch | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>  create mode 100644 package/ca-certificates/0002-remove-eMudhra-parents.patch
> 
> diff --git a/package/ca-certificates/0002-remove-eMudhra-parents.patch b/package/ca-certificates/0002-remove-eMudhra-parents.patch
> new file mode 100644
> index 0000000000..46ff520f56
> --- /dev/null
> +++ b/package/ca-certificates/0002-remove-eMudhra-parents.patch
> @@ -0,0 +1,11 @@
> +diff -Nru ca-certificates/mozilla/blacklist.txt patched/mozilla/blacklist.txt
> +--- ca-certificates/mozilla/blacklist.txt	2026-02-23 16:32:21.000000000 +0100
> ++++ patched/mozilla/blacklist.txt	2026-10-20 16:21:52.412423854 +0200
> +@@ -2,5 +2,7 @@
> + 
> + # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
> + "Explicitly Distrust DigiNotar Root CA"
> ++"emSign ECC Root CA - G3"
> ++"Comodo AAA Services root"
> + 
> + # Expired CAs
> -- 
> 2.56.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
                                        ____________
.-----------------.--------------------:       _    :------------------.
|  Yann E. MORIN  | Real-Time Embedded |    __/ )   | /"\ ASCII RIBBON |
|                 | Software  Designer |  _/ - /'   | \ / CAMPAIGN     |
| +33 638.411.245 '--------------------: (_    `--, |  X  AGAINST      |
| yann.morin (at) orange.com           |_="    ,--' | / \ HTML MAIL    |
'--------------------------------------:______/_____:------------------'

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Florian Larysch]

On Wed, Oct 21, 2026 at 07:22:28AM +0200, yann.morin@orange.com wrote:
> There is also 20260816+nmu1 in sid, which supposedly has the leaked
> certs removed, so maybe we could also bump to that shortly?

AFAICT, it does the exact same thing as my patch[1], so this should be
equivalent.

> Well, I better get errors about legitimate certificates, rather than
> silently connect to compromised hosts.

That's fair, I made the same call for our internal stuff.
 
> And those who have legitimate certs will have to ergenerate new ones
> with a trusted CA anyway, since theirs are no longer trusted by major
> browsers already anyway.

Since the certs that were *actually* compromised are intermediates,
removing the roots (which haven't actually been compromised) is a very
coarse way to resolve this issue that causes collateral damage for CAs
which are actually fine. I think the way browsers are resolving this by
actually only blocking certs which have the broken intermediates in
their chains.

However, there's no generic way to do something similar for an entire
Linux system, hence the root store hack.

[1] https://salsa.debian.org/debian/ca-certificates/-/commit/4a0203e5ce4ce1a064b97387f52ca6a00c97185c

Florian
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Fiona Klute via buildroot]

Am 21.10.26 um 15:34 schrieb Florian Larysch:
> On Wed, Oct 21, 2026 at 07:22:28AM +0200, yann.morin@orange.com wrote:
>> There is also 20260816+nmu1 in sid, which supposedly has the leaked
>> certs removed, so maybe we could also bump to that shortly?
> 
> AFAICT, it does the exact same thing as my patch[1], so this should be
> equivalent.

Yes. I'd say replace the patch with that one plus the usual Upstream and 
S-o-b trailers so everything's tidy, and it can be merged. :-)

Best regards,
Fiona

>> Well, I better get errors about legitimate certificates, rather than
>> silently connect to compromised hosts.
> 
> That's fair, I made the same call for our internal stuff.
>   
>> And those who have legitimate certs will have to ergenerate new ones
>> with a trusted CA anyway, since theirs are no longer trusted by major
>> browsers already anyway.
> 
> Since the certs that were *actually* compromised are intermediates,
> removing the roots (which haven't actually been compromised) is a very
> coarse way to resolve this issue that causes collateral damage for CAs
> which are actually fine. I think the way browsers are resolving this by
> actually only blocking certs which have the broken intermediates in
> their chains.
> 
> However, there's no generic way to do something similar for an entire
> Linux system, hence the root store hack.
> 
> [1] https://salsa.debian.org/debian/ca-certificates/-/commit/4a0203e5ce4ce1a064b97387f52ca6a00c97185c
> 
> Florian
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Thomas Petazzoni via buildroot]

Hello Florian,

On Tue, Oct 20, 2026 at 04:46:55PM +0200, Florian Larysch wrote:

> diff --git a/package/ca-certificates/0002-remove-eMudhra-parents.patch b/package/ca-certificates/0002-remove-eMudhra-parents.patch
> new file mode 100644
> index 0000000000..46ff520f56
> --- /dev/null
> +++ b/package/ca-certificates/0002-remove-eMudhra-parents.patch
> @@ -0,0 +1,11 @@
> +diff -Nru ca-certificates/mozilla/blacklist.txt patched/mozilla/blacklist.txt
> +--- ca-certificates/mozilla/blacklist.txt	2026-02-23 16:32:21.000000000 +0100
> ++++ patched/mozilla/blacklist.txt	2026-10-20 16:21:52.412423854 +0200
> +@@ -2,5 +2,7 @@
> + 
> + # Blacklist explicitly distrusted certificates to explicitly ignore them and prevent build errors
> + "Explicitly Distrust DigiNotar Root CA"
> ++"emSign ECC Root CA - G3"
> ++"Comodo AAA Services root"

As Fiona suggested, could you send a v2 with a properly formatted
patch? This means:

- Git-formatted preferably
- Commit title
- Commit log
- Upstream: tag
- Your Signed-off-by

Could you get back to us with such an updated patch?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] ca-certificates: remove roots chaining to eMudhra intermediates

[Florian Larysch]

Hi Thomas,

I've sent a v2 as requested (in 20261021223139.26912-1-fl@n621.de) and
also an alternative patch (in 20261021223000.26513-1-fl@n621.de) that
just bumps to the nmu version that Yann mentioned. Feel free to pick
either.

Or if there's still something wrong with my patches, just feel free to
redo them yourself if you want to get this out quickly.

Florian
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot