Non-compromised certs from ca_root_nss are blacklisted by the recent update

karolyi

karolyi

Hey,

bugs.freebsd.org. isn't working (HTTP 503 all the time) so I'm posting it here in hopes of catching the attention from someone from devs/staff:

The recent security update blacklisted certs that seemingly haven't been compromised. the package ca_root_nss contains two of them:
  • emSign ECC Root CA - C3
  • emSign Root CA - C1
The problem is, anyone who has the ca_root_nss package installed, will get these blacklisted (but not compromised), and freebsd-update will want to remove them.

They were not compromised (seemingly), information sources: https://emudhra.we-have-a-problem.com/ and the recent security advisory.

Upon running freebsd-update, it ill say that:

The following files are affected by updates. No changes have
been downloaded, however, because the files have been modified
locally:
/etc/ssl/cert.pem


The following files will be removed as part of updating to
15.1-RELEASE-p6:
/etc/ssl/certs/406c9bb1.0
/etc/ssl/certs/4b718d9b.0
Click to expand...

These are the two non-compromised keys, from my investigation.

Anyone who will have ca_root_nss installed (version 3.131 at the time of writing) can run into this issue. The package is required by lots of tools, rclone is one of them in my case. It installs certs into /usr/local/share/certs which certctl picks up and thus modifies /etc/ssl/certs.pem into a state that freebsd-update will reject.

Either this has to be rolled back (maybe with another update) or the certs be removed from ca_root_nss, the latter of which I don't think is a valid solution.
 
You must log in or register to reply here.
Back
Top