From 267dd7941b1eb5060fbc968301294a534f658611 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20A=2EP?=
 <53834183+Jossec101@users.noreply.github.com>
Date: Wed, 21 Oct 2026 09:23:00 +0200
Subject: [PATCH] Distrust compromised eMudhra intermediates

- Eight eMudhra intermediate CA keys leaked on 2026-10-20 (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)
- Anyone holding them can mint a TLS cert for any host, so outbound calls can be intercepted
- The Lambda base is Amazon Linux 2023, which has no ca-certificates release without emSign ECC Root CA - G3 yet
- Blocklist that root with p11-kit and keep upgrading ca-certificates so the AL2023 fix lands on rebuild
---
 RemoteSigner/Dockerfile | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/RemoteSigner/Dockerfile b/RemoteSigner/Dockerfile
index 5f81a73..32d4b4e 100644
--- a/RemoteSigner/Dockerfile
+++ b/RemoteSigner/Dockerfile
@@ -18,5 +18,12 @@ RUN dotnet publish "RemoteSigner.csproj" \
             -p:PublishReadyToRun=true
 
 FROM base AS final
+
+# The eMudhra intermediates compromised in October 2026 chain to this root, and AL2023 has not shipped a ca-certificates release without it yet
+RUN dnf -y upgrade ca-certificates \
+    && awk '/^# emSign ECC Root CA - G3$/{f=1} f&&/BEGIN CERTIFICATE/{p=1} p{print} p&&/END CERTIFICATE/{exit}' /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem > /etc/pki/ca-trust/source/blocklist/emsign-ecc-root-ca-g3.pem \
+    && update-ca-trust extract \
+    && dnf clean all
+
 WORKDIR /var/task
 COPY --from=publish /app/publish .
\ No newline at end of file