diff options
author | Guilhem Moulin <guilhem@fripost.org> | 2020-11-25 19:58:13 +0100 |
---|---|---|
committer | Guilhem Moulin <guilhem@fripost.org> | 2020-11-26 00:16:06 +0100 |
commit | 51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 (patch) | |
tree | fbda1d3514a83cf92593e4ced677bde2338cc27f /Makefile | |
parent | 77844de56889ab441607086b554b111a3e7b03cf (diff) |
Use upstream certicate chain instead of an hardcoded one.upstream/0.7
This is a breaking change. The certificate indicated by 'CAfile' is no
longer used as is in 'certificate-chain' (along with the leaf cert).
The chain returned by the ACME v2 endpoint is used instead. This allows
for more flexbility with respect to key/CA rotation, cf.
https://letsencrypt.org/2020/11/06/own-two-feet.html and
https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018
Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt
which is a concatenation of all known active CA certificates (which
includes the previous default).
Diffstat (limited to 'Makefile')
-rw-r--r-- | Makefile | 14 |
1 files changed, 12 insertions, 2 deletions
@@ -2,7 +2,7 @@ DESTDIR ?= /usr/local BUILDDIR ?= ./build MANUAL_FILES = $(addprefix $(BUILDDIR)/,$(patsubst ./%.md,%,$(wildcard ./*.[1-9].md))) -all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard config/* snippets/*)) +all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard certs/* config/* snippets/*) certs/ca-certificates.crt) doc: manual manual: $(MANUAL_FILES) @@ -11,6 +11,16 @@ manual: $(MANUAL_FILES) $(MANUAL_FILES): $(BUILDDIR)/%: $(BUILDDIR)/%.md pandoc -f markdown -t json -- "$<" | ./pandoc2man.jq | pandoc -s -f json -t man -o "$@" +# used for validation, see https://letsencrypt.org/certificates/ +$(BUILDDIR)/certs/ca-certificates.crt: \ + certs/letsencryptauthorityx[34].pem \ + certs/lets-encrypt-x[34]-cross-signed.pem \ + certs/lets-encrypt-r[34].pem \ + certs/lets-encrypt-r[34]-cross-signed.pem \ + certs/lets-encrypt-e[12].pem + mkdir -pv -- $(BUILDDIR)/certs + cat $^ >$@ + prefix ?= $(DESTDIR) exec_prefix ?= $(prefix) bindir ?= $(exec_prefix)/bin @@ -38,7 +48,7 @@ $(BUILDDIR)/%: % install: all install -m0644 -vDt $(sysconfdir)/lacme $(BUILDDIR)/config/*.conf $(BUILDDIR)/snippets/*.conf install -vd $(sysconfdir)/lacme/lacme-certs.conf.d - install -m0644 -vDt $(datadir)/lacme certs/lets-encrypt-x[1-4]-cross-signed.pem + install -m0644 -vDt $(datadir)/lacme $(BUILDDIR)/certs/* install -m0755 -vDt $(libexecdir)/lacme $(BUILDDIR)/client $(BUILDDIR)/webserver install -m0644 -vDt $(man1dir) $(BUILDDIR)/lacme-accountd.1 install -m0644 -vDt $(man8dir) $(BUILDDIR)/lacme.8 |