From patchwork Fri Oct 23 10:09:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 101780 Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3635.1792750210643484406 for ; Fri, 23 Oct 2026 03:10:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm2 header.b=Tzf+/VMW; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-202610231010083b2a2345b300020768-ttn25j@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 202610231010083b2a2345b300020768 for ; Fri, 23 Oct 2026 12:10:08 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm2; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=qTmUu5E+uduB4UXo/36k1YnPHrgzaw+hawEki891c+E=; b=Tzf+/VMW8o/QdzYjmHH6Dw8DNx11mh01NP0mxLQZcVxjzk9nM9jvqdXb2fIj264+ClemD2 pbWRACoGMz27adrbJWDgOQbJzYEGzq5ZMyYsnyMY1vDGBgD4AfQjEx0UILpLotYo7/V08x7D UK4ywKXOCNxvbyr0llJ6s9TuAHuOvRTrNznrmScXq4bsvEIrLAepl/eP3xSzztYk/EpY0pb/ Up6WhTil21+WFhT0ToeL7svDbRQ52D5cEsm+1CVpVk+5ZC7mvchWAoqiqkrrxJB2MXS54vJu pnHpPlgLItzJnAY3tGNBJPfeomoMBPuFzw6HY6uZGIZGXs8iJwlOPcHQ==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][wrynose][PATCH] nss: remove compromised eMudhra certificates Date: Fri, 23 Oct 2026 12:09:48 +0200 Message-ID: <20261023100948.2643661-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 23 Oct 2026 10:10:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131361 From: Peter Marko See https://emudhra.we-have-a-problem.com/ Signed-off-by: Peter Marko --- ...ve-eMudhra-emSign-Root-CA-C1-and-emS.patch | 272 ++++++++++++++++++ ...ve-eMudhra-emSign-Root-CA-G3-from-NS.patch | 143 +++++++++ meta-oe/recipes-support/nss/nss_3.122.bb | 2 + 3 files changed, 417 insertions(+) create mode 100644 meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch create mode 100644 meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch diff --git a/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch b/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch new file mode 100644 index 0000000000..1353b491f2 --- /dev/null +++ b/meta-oe/recipes-support/nss/nss/0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch @@ -0,0 +1,272 @@ +From 15734105a44679969114534ac5ceaf08e9630dd3 Mon Sep 17 00:00:00 2001 +From: Anna +Date: Tue, 20 Oct 2026 09:03:59 +0000 +Subject: [PATCH] Bug 2083709 - Remove eMudhra emSign Root CA - C1 and emSign + ECC Root CA - C3 from NSS + +Differential Revision: https://phabricator.services.mozilla.com/D335517 + +Upstream-Status: Backport [https://github.com/mozilla/nss/commit/15734105a44679969114534ac5ceaf08e9630dd3] +Signed-off-by: Peter Marko +--- + nss/lib/ckfw/builtins/certdata.txt | 247 ----------------------------- + 1 file changed, 247 deletions(-) + +diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt +index 0a451693c..05172ca23 100644 +--- a/nss/lib/ckfw/builtins/certdata.txt ++++ b/nss/lib/ckfw/builtins/certdata.txt +@@ -13814,253 +13814,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR + CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST + CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +-# +-# Certificate "emSign Root CA - C1" +-# +-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2 +-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F +-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign Root CA - C1" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\013\000\256\317\000\272\304\317\062\370\103\262 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\003\163\060\202\002\133\240\003\002\001\002\002\013\000 +-\256\317\000\272\304\317\062\370\103\262\060\015\006\011\052\206 +-\110\206\367\015\001\001\013\005\000\060\126\061\013\060\011\006 +-\003\125\004\006\023\002\125\123\061\023\060\021\006\003\125\004 +-\013\023\012\145\155\123\151\147\156\040\120\113\111\061\024\060 +-\022\006\003\125\004\012\023\013\145\115\165\144\150\162\141\040 +-\111\156\143\061\034\060\032\006\003\125\004\003\023\023\145\155 +-\123\151\147\156\040\122\157\157\164\040\103\101\040\055\040\103 +-\061\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060 +-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060 +-\132\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123 +-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147 +-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013 +-\145\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006 +-\003\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157 +-\164\040\103\101\040\055\040\103\061\060\202\001\042\060\015\006 +-\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001\017 +-\000\060\202\001\012\002\202\001\001\000\317\353\251\271\361\231 +-\005\314\330\050\041\112\363\163\064\121\204\126\020\365\240\117 +-\054\022\343\372\023\232\047\320\317\371\171\032\164\137\035\171 +-\071\374\133\370\160\216\340\222\122\367\344\045\371\124\203\331 +-\035\323\310\132\205\077\136\307\266\007\356\076\300\316\232\257 +-\254\126\102\052\071\045\160\326\277\265\173\066\255\254\366\163 +-\334\315\327\035\212\203\245\373\053\220\025\067\153\034\046\107 +-\334\073\051\126\223\152\263\301\152\072\235\075\365\301\227\070 +-\130\005\213\034\021\343\344\264\270\135\205\035\203\376\170\137 +-\013\105\150\030\110\245\106\163\064\073\376\017\310\166\273\307 +-\030\363\005\321\206\363\205\355\347\271\331\062\255\125\210\316 +-\246\266\221\260\117\254\176\025\043\226\366\077\360\040\064\026 +-\336\012\306\304\004\105\171\177\247\375\276\322\251\245\257\234 +-\305\043\052\367\074\041\154\275\257\217\116\305\072\262\363\064 +-\022\374\337\200\032\111\244\324\251\225\367\236\211\136\242\211 +-\254\224\313\250\150\233\257\212\145\047\315\211\356\335\214\265 +-\153\051\160\103\240\151\013\344\271\017\002\003\001\000\001\243 +-\102\060\100\060\035\006\003\125\035\016\004\026\004\024\376\241 +-\340\160\036\052\003\071\122\132\102\276\134\221\205\172\030\252 +-\115\265\060\016\006\003\125\035\017\001\001\377\004\004\003\002 +-\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060\003 +-\001\001\377\060\015\006\011\052\206\110\206\367\015\001\001\013 +-\005\000\003\202\001\001\000\302\112\126\372\025\041\173\050\242 +-\351\345\035\373\370\055\304\071\226\101\114\073\047\054\304\154 +-\030\025\200\306\254\257\107\131\057\046\013\343\066\260\357\073 +-\376\103\227\111\062\231\022\025\133\337\021\051\377\253\123\370 +-\273\301\170\017\254\234\123\257\127\275\150\214\075\151\063\360 +-\243\240\043\143\073\144\147\042\104\255\325\161\313\126\052\170 +-\222\243\117\022\061\066\066\342\336\376\000\304\243\140\017\047 +-\255\240\260\212\265\066\172\122\241\275\047\364\040\047\142\350 +-\115\224\044\023\344\012\004\351\074\253\056\310\103\011\112\306 +-\141\004\345\111\064\176\323\304\310\365\017\300\252\351\272\124 +-\136\363\143\053\117\117\120\324\376\271\173\231\214\075\300\056 +-\274\002\053\323\304\100\344\212\007\061\036\233\316\046\231\023 +-\373\021\352\232\042\014\021\031\307\136\033\201\120\060\310\226 +-\022\156\347\313\101\177\221\073\242\107\267\124\200\033\334\000 +-\314\232\220\352\303\303\120\006\142\014\060\300\025\110\247\250 +-\131\174\341\256\042\242\342\012\172\017\372\142\253\122\114\341 +-\361\337\312\276\203\015\102 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign Root CA - C1" +-# Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2 +-# Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F +-# Fingerprint (SHA1): E7:2E:F1:DF:FC:B2:09:28:CF:5D:D4:D5:67:37:B1:51:CB:86:4F:01 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign Root CA - C1" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\347\056\361\337\374\262\011\050\317\135\324\325\147\067\261\121 +-\313\206\117\001 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\330\343\135\001\041\372\170\132\260\337\272\322\356\052\137\150 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\126\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\034\060\032\006\003 +-\125\004\003\023\023\145\155\123\151\147\156\040\122\157\157\164 +-\040\103\101\040\055\040\103\061 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\013\000\256\317\000\272\304\317\062\370\103\262 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- +-# +-# Certificate "emSign ECC Root CA - C3" +-# +-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8 +-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3 +-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - C3" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\173\161\266\202\126\270\022\174\234\250 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\002\053\060\202\001\261\240\003\002\001\002\002\012\173 +-\161\266\202\126\270\022\174\234\250\060\012\006\010\052\206\110 +-\316\075\004\003\003\060\132\061\013\060\011\006\003\125\004\006 +-\023\002\125\123\061\023\060\021\006\003\125\004\013\023\012\145 +-\155\123\151\147\156\040\120\113\111\061\024\060\022\006\003\125 +-\004\012\023\013\145\115\165\144\150\162\141\040\111\156\143\061 +-\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147\156 +-\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040\103 +-\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060\060 +-\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060\060 +-\132\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123 +-\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147 +-\156\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013 +-\145\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\103\063\060\166\060 +-\020\006\007\052\206\110\316\075\002\001\006\005\053\201\004\000 +-\042\003\142\000\004\375\245\141\256\173\046\020\035\351\267\042 +-\060\256\006\364\201\263\261\102\161\225\071\274\323\122\343\257 +-\257\371\362\227\065\222\066\106\016\207\225\215\271\071\132\351 +-\273\337\320\376\310\007\101\074\273\125\157\203\243\152\373\142 +-\260\201\211\002\160\175\110\305\112\343\351\042\124\042\115\223 +-\273\102\014\257\167\234\043\246\175\327\141\021\316\145\307\370 +-\177\376\365\362\251\243\102\060\100\060\035\006\003\125\035\016 +-\004\026\004\024\373\132\110\320\200\040\100\362\250\351\000\007 +-\151\031\167\247\346\303\364\317\060\016\006\003\125\035\017\001 +-\001\377\004\004\003\002\001\006\060\017\006\003\125\035\023\001 +-\001\377\004\005\060\003\001\001\377\060\012\006\010\052\206\110 +-\316\075\004\003\003\003\150\000\060\145\002\061\000\264\330\057 +-\002\211\375\266\114\142\272\103\116\023\204\162\265\256\335\034 +-\336\326\265\334\126\217\130\100\132\055\336\040\114\042\203\312 +-\223\250\176\356\022\100\307\326\207\117\370\337\205\002\060\034 +-\024\144\344\174\226\203\021\234\260\321\132\141\113\246\017\111 +-\323\000\374\241\374\344\245\377\177\255\327\060\320\307\167\177 +-\276\201\007\125\060\120\040\024\365\127\070\012\250\061\121 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign ECC Root CA - C3" +-# Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8 +-# Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3 +-# Fingerprint (SHA1): B6:AF:43:C2:9B:81:53:7D:F6:EF:6B:C3:1F:1F:60:15:0C:EE:48:66 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - C3" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\266\257\103\302\233\201\123\175\366\357\153\303\037\037\140\025 +-\014\356\110\146 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\076\123\263\243\201\356\327\020\370\323\260\035\027\222\365\325 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\132\061\013\060\011\006\003\125\004\006\023\002\125\123\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\024\060\022\006\003\125\004\012\023\013\145 +-\115\165\144\150\162\141\040\111\156\143\061\040\060\036\006\003 +-\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103\040 +-\122\157\157\164\040\103\101\040\055\040\103\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\173\161\266\202\126\270\022\174\234\250 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- + # + # Certificate "Hongkong Post Root CA 3" + # diff --git a/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch b/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch new file mode 100644 index 0000000000..ecc55fa299 --- /dev/null +++ b/meta-oe/recipes-support/nss/nss/0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch @@ -0,0 +1,143 @@ +From 0a2b0c75fa036930d98331b721c0780693a3e17a Mon Sep 17 00:00:00 2001 +From: Anna +Date: Tue, 20 Oct 2026 10:05:35 +0000 +Subject: [PATCH] Bug 2084101 - Remove eMudhra emSign Root CA - G3 from NSS + +Differential Revision: https://phabricator.services.mozilla.com/D335548 + +Upstream-Status: Backport [https://github.com/mozilla/nss/commit/0a2b0c75fa036930d98331b721c0780693a3e17a] +Signed-off-by: Peter Marko +--- + nss/lib/ckfw/builtins/certdata.txt | 119 ----------------------------- + 1 file changed, 119 deletions(-) + +diff --git a/nss/lib/ckfw/builtins/certdata.txt b/nss/lib/ckfw/builtins/certdata.txt +index 05172ca23..9ee50e8d5 100644 +--- a/nss/lib/ckfw/builtins/certdata.txt ++++ b/nss/lib/ckfw/builtins/certdata.txt +@@ -13695,125 +13695,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR + CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST + CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE + +-# +-# Certificate "emSign ECC Root CA - G3" +-# +-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84 +-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B +-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1 +-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - G3" +-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509 +-CKA_SUBJECT MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_ID UTF8 "0" +-CKA_ISSUER MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\074\366\007\251\150\160\016\332\213\204 +-END +-CKA_VALUE MULTILINE_OCTAL +-\060\202\002\116\060\202\001\323\240\003\002\001\002\002\012\074 +-\366\007\251\150\160\016\332\213\204\060\012\006\010\052\206\110 +-\316\075\004\003\003\060\153\061\013\060\011\006\003\125\004\006 +-\023\002\111\116\061\023\060\021\006\003\125\004\013\023\012\145 +-\155\123\151\147\156\040\120\113\111\061\045\060\043\006\003\125 +-\004\012\023\034\145\115\165\144\150\162\141\040\124\145\143\150 +-\156\157\154\157\147\151\145\163\040\114\151\155\151\164\145\144 +-\061\040\060\036\006\003\125\004\003\023\027\145\155\123\151\147 +-\156\040\105\103\103\040\122\157\157\164\040\103\101\040\055\040 +-\107\063\060\036\027\015\061\070\060\062\061\070\061\070\063\060 +-\060\060\132\027\015\064\063\060\062\061\070\061\070\063\060\060 +-\060\132\060\153\061\013\060\011\006\003\125\004\006\023\002\111 +-\116\061\023\060\021\006\003\125\004\013\023\012\145\155\123\151 +-\147\156\040\120\113\111\061\045\060\043\006\003\125\004\012\023 +-\034\145\115\165\144\150\162\141\040\124\145\143\150\156\157\154 +-\157\147\151\145\163\040\114\151\155\151\164\145\144\061\040\060 +-\036\006\003\125\004\003\023\027\145\155\123\151\147\156\040\105 +-\103\103\040\122\157\157\164\040\103\101\040\055\040\107\063\060 +-\166\060\020\006\007\052\206\110\316\075\002\001\006\005\053\201 +-\004\000\042\003\142\000\004\043\245\014\270\055\022\365\050\363 +-\261\262\335\342\002\022\200\236\071\137\111\115\237\311\045\064 +-\131\164\354\273\006\034\347\300\162\257\350\256\057\341\101\124 +-\207\024\250\112\262\350\174\202\346\133\152\265\334\263\165\316 +-\213\006\320\206\043\277\106\325\216\017\077\004\364\327\034\222 +-\176\366\245\143\302\365\137\216\056\117\241\030\031\002\053\062 +-\012\202\144\175\026\223\321\243\102\060\100\060\035\006\003\125 +-\035\016\004\026\004\024\174\135\002\204\023\324\314\212\233\201 +-\316\027\034\056\051\036\234\110\143\102\060\016\006\003\125\035 +-\017\001\001\377\004\004\003\002\001\006\060\017\006\003\125\035 +-\023\001\001\377\004\005\060\003\001\001\377\060\012\006\010\052 +-\206\110\316\075\004\003\003\003\151\000\060\146\002\061\000\276 +-\363\141\317\002\020\035\144\225\007\270\030\156\210\205\005\057 +-\203\010\027\220\312\037\212\114\350\015\033\172\261\255\325\201 +-\011\107\357\073\254\010\004\174\134\231\261\355\107\007\322\002 +-\061\000\235\272\125\374\251\112\350\355\355\346\166\001\102\173 +-\310\370\140\331\215\121\213\125\073\373\214\173\353\145\011\303 +-\370\226\315\107\250\202\362\026\125\167\044\176\022\020\225\004 +-\054\243 +-END +-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE +-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE +-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE +- +-# Trust for "emSign ECC Root CA - G3" +-# Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84 +-# Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN +-# Not Valid Before: Sun Feb 18 18:30:00 2018 +-# Not Valid After : Wed Feb 18 18:30:00 2043 +-# Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B +-# Fingerprint (SHA1): 30:43:FA:4F:F2:57:DC:A0:C3:80:EE:2E:58:EA:78:B2:3F:E6:BB:C1 +-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST +-CKA_TOKEN CK_BBOOL CK_TRUE +-CKA_PRIVATE CK_BBOOL CK_FALSE +-CKA_MODIFIABLE CK_BBOOL CK_FALSE +-CKA_LABEL UTF8 "emSign ECC Root CA - G3" +-CKA_CERT_SHA1_HASH MULTILINE_OCTAL +-\060\103\372\117\362\127\334\240\303\200\356\056\130\352\170\262 +-\077\346\273\301 +-END +-CKA_CERT_MD5_HASH MULTILINE_OCTAL +-\316\013\162\321\237\210\216\320\120\003\350\343\270\213\147\100 +-END +-CKA_ISSUER MULTILINE_OCTAL +-\060\153\061\013\060\011\006\003\125\004\006\023\002\111\116\061 +-\023\060\021\006\003\125\004\013\023\012\145\155\123\151\147\156 +-\040\120\113\111\061\045\060\043\006\003\125\004\012\023\034\145 +-\115\165\144\150\162\141\040\124\145\143\150\156\157\154\157\147 +-\151\145\163\040\114\151\155\151\164\145\144\061\040\060\036\006 +-\003\125\004\003\023\027\145\155\123\151\147\156\040\105\103\103 +-\040\122\157\157\164\040\103\101\040\055\040\107\063 +-END +-CKA_SERIAL_NUMBER MULTILINE_OCTAL +-\002\012\074\366\007\251\150\160\016\332\213\204 +-END +-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR +-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST +-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE +- + # + # Certificate "Hongkong Post Root CA 3" + # diff --git a/meta-oe/recipes-support/nss/nss_3.122.bb b/meta-oe/recipes-support/nss/nss_3.122.bb index 70aee3d9db..6c19d4aa6d 100644 --- a/meta-oe/recipes-support/nss/nss_3.122.bb +++ b/meta-oe/recipes-support/nss/nss_3.122.bb @@ -32,6 +32,8 @@ SRC_URI = "https://ftp.mozilla.org/pub/security/nss/releases/${VERSION_DIR}/src/ file://0005-nss-does-not-build-on-mips-with-clang-because-wrong-.patch \ file://0006-Fix-nss-multilib-build-on-openSUSE-11.x-32bit.patch \ file://0007-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \ + file://0008-Bug-2083709-Remove-eMudhra-emSign-Root-CA-C1-and-emS.patch \ + file://0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch \ " SRC_URI[sha256sum] = "2699478b843b9f09c61f85341578df514463a0069447c816bef0d59bd800d777"