Replies

• 

  redsakanaredsakana@infosec.exchange

  Oct 20, 2026, 3:07 PM

  @netbsd
  According to the circulating mailing list post, the affected roots are G3, not C3 or C1

  edit: also Comodo AAA Services Root needs to be removed. This may have more blast radius than emSign in some circumstances, though this (ancient) CA seems to be already gone from some root programs

  💬 1🔄 1⭐ 0
• 

  Clemensneverpanic@chaos.social

  Oct 20, 2026, 3:27 PM

  @redsakana @netbsd While that is correct, the CA itself has asked to remove the C3 and C1 root from Mozilla's trust store, though: https://bugzilla.mozilla.org/show_bug.cgi?id=2083709

  So I guess removing that as well isn't a bad idea.

  💬 0🔄 1⭐ 0
• 

  release_candidaterelease_candidate@bsd.cafe

  Oct 20, 2026, 4:12 PM

  @netbsd Different certificates have been listed here:

  https://emudhra.we-have-a-problem.com/

  ```
  certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem

  certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem
  ```

  💬 0🔄 0⭐ 0