Nexigon Agent v0.6.1

Security release. All HTTPS connections now use only the operating system's trust store and reject the compromised eMudhra intermediate CA keys.

Back to Nexigon Agent releases

Release Notes

Security release. All HTTPS connections now use only the operating system's trust store and reject the compromised eMudhra intermediate CA keys.

Security

This release responds to the compromise of eight eMudhra intermediate certificate authorities. Anyone holding the keys of the six TLS intermediates can impersonate any HTTPS server to clients that trust them. See the incident page and the security advisory for details.

The connection to Nexigon Hub has always used the operating system’s trust store. In versions up to 0.6.0, pairing-key provisioning, repository asset uploads, and OTLP export also trusted root certificates compiled into Nexigon Agent, including emSign ECC Root CA - G3, to which the compromised intermediates chain. Nexigon Agent 0.6.1 verifies all HTTPS connections against the operating system’s trust store only. It also rejects certificate chains that contain any of the compromised intermediate keys, regardless of the trust store’s contents.

Upgrading

Upgrade Nexigon Agent on your devices. No configuration changes are required.

Also update the ca-certificates package in your device images so that it no longer trusts the affected roots. The connection to Nexigon Hub and most other software on your devices rely on it.

Assets