[squid-users] Blocking compromised intermediate certificates (eMudhra incident)

[Andrey K]

Hello,

I am sure you all have heard about the security incident with the eMudhra
CA.

I would like to know if there is a way to configure Squid to block sites
that have the compromised intermediate certificates in their certification
chains. I do not want to untrust or block the Root certificates, only the
specific compromised intermediates.

Is there any built-in mechanism or a recommended practice in Squid to
achieve this (e.g., using specific tls_outgoing_options or ssl_bump acl)?

Kind regards,
    Ankor.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20261023/d9c140cd/attachment.htm>