eMudhra TLS/SSL CA compromise

In the event of a certificate authority being compromised, the trust system of TLS/SSL (which encrypt a large volume of Internet traffic) is broken. Unfortunately, much like Mozilla, Microsoft, Apple, and Google Chrome, NetBSD shipped eMudhra CA certificates with the default install. These certificates are now known to be compromised. There is a fix available for all supported versions of NetBSD.

Run the following commands as root on NetBSD 10 and later to revoke the trust of the compromised CAs and resolve the problem:

# certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem
# certctl untrust /usr/share/certs/mozilla/all/Comodo_AAA_Services_root.pem

Users who have chosen to use mozilla-rootcerts from pkgsrc (this is not a default configuration) should update pkgsrc from cvs, replace the package, and then use the included mozilla-rootcerts script to replace their installed certificates.

For updates on the situation and a test to check whether a system is affected, go to emudhra.we-have-a-problem.com.