mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-14 12:33:29 +01:00
ryan4yin | 二花
0dcf547d1f
Assisted-by: DeepSeek Harness 0.2.1-rc.2 (gpt-6.1-sol) Assisted-by: DeepSeek Harness 0.2.1-rc.2 (deepseek-flash)
17 lines
547 B
Nix
17 lines
547 B
Nix
{
|
|
# Add my private PKI's CA certificate to the system-wide trust store.
|
|
security.pki.certificateFiles = [
|
|
../../certs/ecc-ca.crt
|
|
];
|
|
|
|
# Distrust the roots that signed the compromised eMudhra intermediates
|
|
# (Mozilla advisory, 2026-10-20). Upstream nixpkgs blacklists them as of
|
|
# NixOS/nixpkgs#576390; drop this once every consumed nixpkgs revision has it (WA-040).
|
|
security.pki.caCertificateBlacklist = [
|
|
"Comodo AAA Services root"
|
|
"emSign ECC Root CA - G3"
|
|
"emSign Root CA - C1"
|
|
"emSign ECC Root CA - C3"
|
|
];
|
|
}
|