Commit 458c6e1

HPCesia <me@hpcesia.com>
2026-10-21 01:25:15
security: distrust leaked CA
main
1 parent ccd0705
Changed files (1)
modules
core
security
network.nix
modules/core/security/network.nix
@@ -20,6 +20,15 @@
         "net.ipv6.conf.all.accept_source_route" = lib.mkDefault "0";
         "net.ipv6.conf.default.accept_source_route" = lib.mkDefault "0";
       };
+
+      # See https://github.com/NixOS/nixpkgs/pull/576390
+      # TODO: remove this after the PR above merged into nixpkgs/nixos-unstable
+      security.pki.caCertificateBlacklist = [
+        "Comodo AAA Services root"
+        "emSign ECC Root CA - G3"
+        "emSign Root CA - C1"
+        "emSign ECC Root CA - C3"
+      ];
     };
   };
 }