Re: eMudhra TLS/SSL CA compromise

[Greg Troxel <gdt%lexort.com@localhost>]

Indeed, the problem is that lists of trust anchors are in many more
places than they should be.   Basically:

  certctl for NetBSD 10 and newer

  mozilla-rootcerts-openssl for NetBSD 9 and older, and probably some
  others

  many other systems have their own scheme

and then

  nss, gnutls, and similar all do something that needs understanding and
  checking

  some packages have their own

  mozilla-rootcerts for some packages that use that instead of system

  rust crates and similar for programs that vendor in libraries

so it's harder than you would have guessed last week.