[busterb]

commit 1eea1c6f38bb35e5d4b21957cc5bc4dcbe03d666
Author: beck <>
Date: Tue Oct 20 22:10:27 2026 +0000

Handle the Emudhra intermediate cert compromise.

See https://emudhra.we-have-a-problem.com/

While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.

For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.

This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.

ok tb@ sthen@

[botovq]

Looks good to me. The "Upgrade note:" with the 'no longer replaces' does not apply to 7_9 and 7_8, btw.

[botovq]

for macos: #1430 (only needed for 8_0)

[botovq]

Seems github hides what actually happened here quite well. This pulls in slightly more than strictly needed, but I'm fine with that.

[busterb]

When I used merge, it became almost impossible to see what happened in the diff, so I cherry-picked for the sake of readability into 8_0: 14823b4

[botovq]

I looked at it locally. Looks all good from here.