Hi,
The /etc/ssl/certs/ca-certificates.crt (ca-bundle) package in NethSecurity 8.8.0 still includes the distrusted emSign ECC Root CA - G3 certificate (SHA-256: 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B), as well as the cross-signing AAA Certificate Services root.
Following the October 2026 compromise of 8 eMudhra subordinate CAs (CVE-2026-111943, weak keys factored), major browsers and Linux distributions have removed emSign ECC Root CA - G3 and blocked the compromised intermediates. Since OpenWrt/NethSecurity CLI tools (curl, uclient-fetch, wget, openssl) validate against ca-certificates.crt without CRL/OCSP checks, outbound HTTPS connections initiated by the firewall (Threat Shield blocklists, IPS signatures, DoH/DoT, controller communication) remain vulnerable to MitM spoofing via both the direct eMudhra chain and the AAA Certificate Services cross-signed path.
Verification on an up-to-date NethSecurity 8.8.0 instance:
root@nethsec:~# openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt | openssl pkcs7 -print_certs -noout | grep -i "emSign ECC Root CA - G3"
subject=C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
issuer=C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
subject=C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
issuer=C=IN, OU=emSign PKI, O=eMudhra Technologies Limited, CN=emSign ECC Root CA - G3
Could you please provide an updated ca-bundle / ca-certificates package for NethSecurity 8.8.0 that removes emSign ECC Root CA - G3 (and addresses the AAA Certificate Services cross-signed path)?
Thanks!