Hi. With all the uproar over PHP2Shell, the previous problem of the eMudhra security certificate private keys doesn't seem to have been mentioned here, so I thought I'd ask to make sure ca-certificates.tcz has been updated. There is some more information on the security issue at
https://emudhra.we-have-a-problem.com/ and
https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/, but essentially, a load of private keys of eMudhra root certificates turned out to be single byte numbers (the lowest infamously being 0x4) so any certificates based on eMudhra ones had to be regenerated and anyone (including and especially scammers) can generate a security certificate signed by those root certificates' keys for any domain they want, such that any user who hasn't updated their certificate bundle (or that of their web browser) can have their connections MITMed, with not much additional effort (literally just a DNS redirect away from squatting any domain in the world). Most mainstream web browsers have their own certificate stack and have automatically blocked any certificates signed by these keys, but some browsers and most other tools rely on the certificate bundle, which for TinyCore is stored in ca-certificates.tcz (or, in some older versions, carootcerts.tcz) and I can't see it mentioned in the updates list:
http://tinycorelinux.net/17.x/x86/tcz/updates/updatelist.txt. There's an updated bundle on the cURL project's website, which could be repackaged for TinyCore:
https://curl.se/docs/caextract.html, if that helps.
Looks like the extension is maintained by juanito and Rich:
http://tinycorelinux.net/17.x/x86/tcz/ca-certificates.tcz.info?
Welcome
FAQ
Downloads
Wiki
