Tiny Core Linux
Tiny Core Extensions => TCE Talk => Topic started by: DHeadshot on October 24, 2026, 12:47:06 PM
-
Hi. With all the uproar over PHP2Shell, the previous problem of the eMudhra security certificate private keys doesn't seem to have been mentioned here, so I thought I'd ask to make sure ca-certificates.tcz has been updated. There is some more information on the security issue at https://emudhra.we-have-a-problem.com/ (https://emudhra.we-have-a-problem.com/) and https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ (https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/), but essentially, a load of private keys of eMudhra root certificates turned out to be single byte numbers (the lowest infamously being 0x4) so any certificates based on eMudhra ones had to be regenerated and anyone (including and especially scammers) can generate a security certificate signed by those root certificates' keys for any domain they want, such that any user who hasn't updated their certificate bundle (or that of their web browser) can have their connections MITMed, with not much additional effort (literally just a DNS redirect away from squatting any domain in the world). Most mainstream web browsers have their own certificate stack and have automatically blocked any certificates signed by these keys, but some browsers and most other tools rely on the certificate bundle, which for TinyCore is stored in ca-certificates.tcz (or, in some older versions, carootcerts.tcz) and I can't see it mentioned in the updates list: http://tinycorelinux.net/17.x/x86/tcz/updates/updatelist.txt (http://tinycorelinux.net/17.x/x86/tcz/updates/updatelist.txt). There's an updated bundle on the cURL project's website, which could be repackaged for TinyCore: https://curl.se/docs/caextract.html (https://curl.se/docs/caextract.html), if that helps.
Looks like the extension is maintained by juanito and Rich: http://tinycorelinux.net/17.x/x86/tcz/ca-certificates.tcz.info (http://tinycorelinux.net/17.x/x86/tcz/ca-certificates.tcz.info)?
-
There's an updated bundle on the cURL project's website, which could be repackaged for TinyCore: https://curl.se/docs/caextract.html (https://curl.se/docs/caextract.html), if that helps.
ca-certificates.tcz.info (http://tinycorelinux.net/17.x/x86/tcz/ca-certificates.tcz.info) says it's based on the Debian package, so note that Debian have also fixed it there (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151413).
-
I use the curl mk-ca-bundle.pl, which pulls the data from
https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/release/security/nss/lib/ckfw/builtins/certdata.txt
-
ca-certificates.tcz
Description: ca-certificates
Current: 2026/10/25 updated to latest certificates
Uploaded on Sun Oct 25 10:27I presume the date/times in the update list aren't UTC, but I guess it's been fixed now.
-
I could see the update on 17.x (thanks!)
(example: http://repo.tinycorelinux.net/17.x/x86_64/tcz/ca-certificates.tcz.info)
Is there any plan to backport this to older MajorVersions repo tree ?
-
We only maintain the repo for the current version.