Add (self-signed) ISRG Roots to the CA bundle.

This allows us to fully validate provided X.509 chains using that
self-contained bundle, regardless of which CAs is marqued as trusted
under /etc/ssl/certs.

Also, remove cross-signed intermediate CAs from the bundle as they're
useless in a self-contained bundle.

Also, remove decomissioned intermediate CAs Authority X3 and X4 from the
bundle.

This change bumps the minimum OpenSSL version to 1.1.0 (for
verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options).

1 files changed, 1 insertions, 1 deletions

diff --git a/INSTALL b/INSTALL
index a0fcb72..9ecb1bf 100644
--- a/INSTALL
+++ b/INSTALL
@@ -16,7 +16,7 @@ the following command:
     apt-get install libconfig-tiny-perl libcrypt-openssl-rsa-perl libcrypt-openssl-bignum-perl libjson-perl
 
 
-lacme depends on OpenSSL and the following Perl modules:
+lacme depends on OpenSSL ≥1.1.0 and the following Perl modules:
 
   - Config::Tiny
   - Digest::SHA (core module)