Repository navigation
Update bundled certs to remove emSign roots (eMudhra compromise) - #925
Merged
Merged
Conversation
Removes emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3 per the Oct 20 2026 Mozilla bundle, following the eMudhra intermediate CA compromise. Closes excon#924 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
geemus
approved these changes
Oct 21, 2026
geemus
left a comment
Contributor
There was a problem hiding this comment.
lgtm (I also checked this out locally and re-ran the rake command to ensure the contents didn't change, since it's a bit hard to review by eye). Thanks!
Contributor
|
Released in v1.8.0 |
galadran
pushed a commit
to galadran/we-have-a-problem.com
that referenced
this pull request
Oct 23, 2026
The excon gem includes certificates and it removed emSign roots in v1.8.0: excon/excon#925
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #924
This regenerates
data/cacert.pemwithrake update_cacertfrom the current curl/Mozilla bundle (Oct 20 2026). It removes the emSign roots that Mozilla dropped after the eMudhra intermediate CA compromise. One of those roots,emSign ECC Root CA - G3, cross-signed the compromised intermediates.The rest of the diff is the new header and the per-cert
# Fingerprint (SHA-256)comments added by mk-ca-bundle.pl 1.35.🤖 Generated with Claude Code