Re: eMudhra TLS/SSL CA compromise

[beaker%sdf.org@localhost (beaker)]

beaker%sdf.org@localhost (beaker) wrote:

> I came across the security advisory in the subject line on the
> NetBSD blog[1] but the proposed short-term remedy of untrusting
> the /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem cert
> doesn't work as the forementioned cert appears to be embedded in
> the /usr/pkg/share/mozilla-rootcerts/cacerts.pem file and it appears
> as if certctl(8) is designed to work with individual pem files.
> Is there some way to deal with this issue other than outright
> removing the mozilla-rootcerts package?
>
> -B
>
> [1] https://blog.netbsd.org/tnf/entry/emudhra_tls_ssl_ca_compromise

Nevermind - I'm clearly too tired to be trying to parse this info;
totally missed "update via CVS for pkgsrc mozilla-rootcert".. Think
I'll just wait until the update makes its way into the binary pkgs.

-B