lacme/certs/letsencryptauthorityx4.pem, branch v0.8.4 Small ACME client written with process isolation and minimal privileges in mind certs/*, cert-staging/*: Remove intermediate and expired certificates. 2024-06-13T14:48:06+00:00 Guilhem Moulin guilhem@fripost.org 2024-06-13T12:47:08+00:00 83f4cabd85c240cd0f13fdd4c88266648eb0a90c Only the root certificates are now used as trust anchor. 
Only the root certificates are now used as trust anchor.
Use upstream certicate chain instead of an hardcoded one. 2020-11-25T23:16:06+00:00 Guilhem Moulin guilhem@fripost.org 2020-11-25T18:58:13+00:00 51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default). 
This is a breaking change.  The certificate indicated by 'CAfile' is no
longer used as is in 'certificate-chain' (along with the leaf cert).
The chain returned by the ACME v2 endpoint is used instead.  This allows
for more flexbility with respect to key/CA rotation, cf.
https://letsencrypt.org/2020/11/06/own-two-feet.html and
https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018

Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt
which is a concatenation of all known active CA certificates (which
includes the previous default).