diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2021-02-14 22:59:11 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2021-02-15 01:31:27 +0100 |
| commit | 2c1a396728a381685923f7b1c4dea53d225112fc (patch) | |
| tree | 2de0abe91788ea9c795e91eba38e69069412bfb1 /Makefile | |
| parent | 956764d11c9445c835f992a782d90d8de90fe565 (diff) | |
Add (self-signed) ISRG Roots to the CA bundle.
This allows us to fully validate provided X.509 chains using that
self-contained bundle, regardless of which CAs is marqued as trusted
under /etc/ssl/certs.
Also, remove cross-signed intermediate CAs from the bundle as they're
useless in a self-contained bundle.
Also, remove decomissioned intermediate CAs Authority X3 and X4 from the
bundle.
This change bumps the minimum OpenSSL version to 1.1.0 (for
verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options).
Diffstat (limited to 'Makefile')
| -rw-r--r-- | Makefile | 7 |
1 files changed, 3 insertions, 4 deletions
@@ -13,13 +13,12 @@ $(MANUAL_FILES): $(BUILDDIR)/%: $(BUILDDIR)/%.md # used for validation, see https://letsencrypt.org/certificates/ $(BUILDDIR)/certs/ca-certificates.crt: \ - certs/letsencryptauthorityx[34].pem \ - certs/lets-encrypt-x[34]-cross-signed.pem \ + certs/isrgrootx1.pem \ + certs/isrg-root-x2.pem \ certs/lets-encrypt-r[34].pem \ - certs/lets-encrypt-r[34]-cross-signed.pem \ certs/lets-encrypt-e[12].pem mkdir -pv -- $(BUILDDIR)/certs - cat $^ >$@ + cat -- $^ >$@ prefix ?= $(DESTDIR) exec_prefix ?= $(prefix) |