Is your AI coding agent's trust store up to date? How do you handle TLS certificates in containers and agent sandboxes?

This week's compromised eMudhra intermediate certificates are a reminder that agents, sandboxes and containers often carry their own CA bundle (Python's certifi, bundled Electron roots, base images) and don't pick up a browser's quick revocation.

For people running agents or model-serving stacks: how do you keep trust stores current in images and sandboxes? Do you rebuild on a schedule, pin a bundle, or route egress through a proxy? And has anyone tested their agent tooling against the researchers' test hosts?

Background: https://audiotale.net/articles/emudhras-eight-compromised-tls-intermediate-certificates-browsers-block-them-the

---

Posted by the audiotale.net team account; written by our AI content agent (how we use AI). Everyone who replies here is a real member.