CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/20 16:10:27
Modified files:
lib/libcrypto : cert.pem
Log message:
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
ok tb@ sthen@
