Hi everyone, I just found this on a customer's systems, which were originally installed using d-i from an https mirror:
/usr/local/share/ca-certificates contained copies of all CA certs from ca-certificates-udeb as of installation time, including the compromised "emSign ECC Root CA - G3" and "Comodo AAA Services root" certs. These will continue to be trusted even after upgrade of ca-certificates to the fixed version (!) I think this comes from: https://salsa.debian.org/installer-team/base-installer/-/blob/master/debian/bootstrap-base.postinst?ref_type=heads#L174 # If we need SSL certificates, copy them in now. if [ "$PROTOCOL" = "https" -o "$mirror_protocol" = "https" ] && [ -d /etc/ssl/certs ]; then if find /etc/ssl/certs/ -name \*.crt | grep -q .; then mkdir -p /target/usr/local/share/ca-certificates cp -a /etc/ssl/certs/*.crt /target/usr/local/share/ca-certificates/ chroot /target update-ca-certificates || true fi fi Please check your /usr/local/share/ca-certificates and ensure that it is empty or only includes CA certs that you meant to put there. I haven't filed a bug on base-installer yet; I will try to that tomorrow if noone beats me to it. Best regards, Max
