[squid-users] Blocking compromised intermediate certificates (eMudhra incident)

[Alex Rousskov]

On 2026-10-23 05:04, Andrey K wrote:

> I would like to know if there is a way to configure Squid to block sites 
> that have the compromised intermediate certificates in their 
> certification chains. I do not want to untrust or block the Root 
> certificates, only the specific compromised intermediates.

I can suggest investigating two solutions, both untested by me:

1. Add the corresponding CRL to your OpenSSL trust store. This was 
suggested and then possibly implied as working at [^1].

2. Write a custom sslcrtvalidator_program helper.

[^1]: "will do the trick for openssl" comment inside the "Rejecting 
intermediate CA certificates" thread at 
https://groups.google.com/a/openssl.org/g/openssl-users/c/KKI-Py0piWc/m/EEGsMTFsBAAJ


HTH,

Alex.