Re: security/60908: mozilla-certdata: update for compromised CA

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

> Date: Tue, 20 Oct 2026 14:58:37 +0000
> From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
> 
> Workaround:
> 
> certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_C3.pem
> certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3
> certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_C1.pem
> 
> (Not sure all of these were compromised but they were all removed from
> certdata.txt.)

Corrected workaround:

certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem
certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem

Various tests for whether it worked are posted at:

https://emudhra.we-have-a-problem.com/

For example, you can try:

ftp -V -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/
ftp -V -o /dev/null https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

If either one quietly succeds, you are in trouble.