From 35f3e4cec153e70de0cacd4d66bf0285fde29912 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Wed, 21 Oct 2026 13:52:31 +0400
Subject: [PATCH] security: distrust two Mozilla root CAs

Blacklist "Comodo AAA Services root" and "emSign ECC Root CA - G3"
so they are left out of /etc/ssl/certs/ca-certificates.crt.

Mozilla already distrusted the Comodo root for serverAuth (it was only
trusted for email), so emSign ECC G3 is the only root this removes for
TLS. Apps that ship their own trust store (NSS in browsers, certifi,
Java cacerts) are not affected.

Assisted-by: Claude:opus-5-5
---
 modules/security.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/modules/security.nix b/modules/security.nix
index 77a12e8..a614c67 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -45,6 +45,12 @@
     "net.ipv6.conf.default.accept_redirects" = 0;
   };
 
+  # Drop these roots from the system CA bundle (names must match bundle labels)
+  security.pki.caCertificateBlacklist = [
+    "Comodo AAA Services root"
+    "emSign ECC Root CA - G3"
+  ];
+
   # USBGuard configuration
   services.usbguard = {
     enable = false;