← Back to context Comment by ChrisRR 7 hours ago I'm no expert in the matter, but weren't only the intermediate CAs compromised, not the root? 2 comments ChrisRR Reply ratorx 7 hours ago Yep, but the certs.pem file only contains the root and does not know anything about intermediates.So the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is to revoke the root. brewmarche 3 hours ago I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.
ratorx 7 hours ago Yep, but the certs.pem file only contains the root and does not know anything about intermediates.So the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is to revoke the root. brewmarche 3 hours ago I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.
brewmarche 3 hours ago I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.
Yep, but the certs.pem file only contains the root and does not know anything about intermediates.
So the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is to revoke the root.
I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.