block-emudhra-certs  --  README
==================================

WHAT THIS IS
------------
A small script that makes the Java runtime inside KNIME Analytics Platform
refuse two root certificates. Those roots sit above the compromised eMudhra
intermediate certificate authorities. Blocking them is the public workaround
described at https://emudhra.we-have-a-problem.com/

Blocked roots:
  emSign ECC Root CA - G3
  AAA Certificate Services

Two versions of the script are included. They do the same thing.
  block-emudhra-certs.ps1   Windows
  block-emudhra-certs.sh    macOS and Linux

The script only ever adds two lines to one file inside the Java runtime
that ships with KNIME:
  <KNIME folder>\plugins\org.knime.binary.jre...\jre\lib\security\blocked.certs
It does not change KNIME settings, your workflows, or the Windows / macOS
certificate stores.


IMPORTANT: DO NOT DOUBLE-CLICK THE SCRIPT
-----------------------------------------
Double-clicking does nothing useful. On Windows the .ps1 file opens in
Notepad. On a machine with Git installed the .sh file opens a window that
closes immediately. The script needs to be told where KNIME is installed,
so it must be started from a terminal as shown below.


BEFORE YOU START
----------------
1. Close KNIME Analytics Platform completely. The fix is only read when
   KNIME starts.
2. Find your KNIME installation folder.
     Windows, installer:   C:\Program Files\KNIME
     Windows, zip:         wherever you unpacked it, e.g. C:\knime_5.12.0
     macOS:                /Applications/KNIME 5.12.0.app   (name includes the version)
     Linux:                wherever you unpacked it, e.g. /home/<you>/knime_5.12.0
3. Optional but recommended: make a backup copy of the file
     <KNIME folder>\plugins\org.knime.binary.jre...\jre\lib\security\blocked.certs
   and keep the copy OUTSIDE the KNIME folder, for example next to this
   README.


WINDOWS
-------
1. Open PowerShell.
   If KNIME is under C:\Program Files, open it as administrator:
   Start menu -> type "PowerShell" -> right-click -> Run as administrator.
   Otherwise a normal PowerShell window is enough.

2. Run the command below. Adjust the two paths to where the script and
   KNIME are on your machine. Keep the quotes; paths with spaces need them.

   powershell -ExecutionPolicy Bypass -File "C:\Users\<you>\Downloads\block-emudhra-certs\block-emudhra-certs.ps1" "C:\Program Files\KNIME"

3. Expected output: two lines, each ending in "blocked" and a long
   fingerprint, for example

   C:\Program Files\KNIME\plugins\...\jre\lib\security\blocked.certs: blocked 86A1ECBA...
   C:\Program Files\KNIME\plugins\...\jre\lib\security\blocked.certs: blocked D7A7A0FB...

   That means it worked.


MACOS AND LINUX
---------------
1. Open Terminal.

2. Run the command below. Adjust the two paths. Keep the quotes.

   macOS:
   sh "/Users/<you>/Downloads/block-emudhra-certs/block-emudhra-certs.sh" "/Applications/KNIME 5.12.0.app"

   Linux:
   sh "/home/<you>/Downloads/block-emudhra-certs/block-emudhra-certs.sh" "/home/<you>/knime_5.12.0"

   If you see "Permission denied", put "sudo " in front of the command and
   enter your password when asked.

3. Expected output: two lines, each ending in "blocked" and a long
   fingerprint. That means it worked.


IF SOMETHING ELSE IS PRINTED
----------------------------
"No lib\security\blocked.certs below: ..."
    The folder you gave is not a KNIME installation, or the path is
    misspelled. Check step 2 under BEFORE YOU START.

"Access to the path ... is denied" / "Permission denied"
    You need administrator rights for that folder. Windows: reopen
    PowerShell as administrator. macOS / Linux: use sudo.

"... not a SHA-256 blocked.certs"
    The file inside this KNIME is in an unexpected format. Do not edit it
    by hand; contact KNIME support and mention this message.

Nothing at all is printed
    The fix was already applied. Running the script again never adds the
    lines twice.

A block of text starting with "Distrust the roots..."
    You started the script without a KNIME folder. Add the folder path at
    the end of the command.


AFTER RUNNING
-------------
- Start KNIME as usual. It starts normally; there is no message about the
  change.
- Connections from KNIME to servers whose certificate chain ends in one of
  the two blocked roots will now fail with a certificate error (typically
  "PKIX path building failed"). That is the intended effect of the
  workaround, not a new problem in KNIME.
- You have several KNIME installations? Run the script once per
  installation folder, or pass all folders in one command separated by
  spaces.
- REPEAT AFTER EVERY KNIME UPDATE. Each KNIME version brings its own Java
  runtime with a fresh blocked.certs file, so an update silently removes
  the fix. Just run the same command again.


HOW TO UNDO
-----------
Close KNIME, then either copy your backup of blocked.certs back over the
file inside the KNIME folder, or open that file in a text editor and delete
the last two lines, which are the two fingerprints below. Start KNIME again.

  86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B
  D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4


OTHER JAVA SOFTWARE
-------------------
The same script works for any Java runtime, not only KNIME. Pass the
folder of that runtime or application instead of the KNIME folder.
