eMudhra Intermediate CA Compromise

[bamf]

Hi,

Using Squid on my OPNsense and the test website tells me that 6 (emSign Root TLS CA - G3) out of 12 Domains are able to connect https://emudhra.we-have-a-problem.com/

How do we get the updated revocation list into Squid?

[bamf]

No ideas? So using Squid is a security risk now?

[Greelan]

OPNsense has yet to ship the patched FreeBSD caroot, or the patched ca_root_nss from ports (or a patched py313-certifi for that matter, though that doesn't affect Squid, and ports doesn't even have it yet).

You can manually remove the certs / mark them untrusted, and rebuild the trust store, in the meantime.