path: root/Makefile
diff options
authorGuilhem Moulin <guilhem@fripost.org>2020-11-25 19:58:13 +0100
committerGuilhem Moulin <guilhem@fripost.org>2020-11-26 00:16:06 +0100
commit51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 (patch)
treefbda1d3514a83cf92593e4ced677bde2338cc27f /Makefile
parent77844de56889ab441607086b554b111a3e7b03cf (diff)
Use upstream certicate chain instead of an hardcoded one.upstream/0.7
This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default).
Diffstat (limited to 'Makefile')
1 files changed, 12 insertions, 2 deletions
diff --git a/Makefile b/Makefile
index 757a581..a4098de 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ DESTDIR ?= /usr/local
BUILDDIR ?= ./build
MANUAL_FILES = $(addprefix $(BUILDDIR)/,$(patsubst ./%.md,%,$(wildcard ./*.[1-9].md)))
-all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard config/* snippets/*))
+all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard certs/* config/* snippets/*) certs/ca-certificates.crt)
doc: manual
manual: $(MANUAL_FILES)
@@ -11,6 +11,16 @@ manual: $(MANUAL_FILES)
pandoc -f markdown -t json -- "$<" | ./pandoc2man.jq | pandoc -s -f json -t man -o "$@"
+# used for validation, see https://letsencrypt.org/certificates/
+$(BUILDDIR)/certs/ca-certificates.crt: \
+ certs/letsencryptauthorityx[34].pem \
+ certs/lets-encrypt-x[34]-cross-signed.pem \
+ certs/lets-encrypt-r[34].pem \
+ certs/lets-encrypt-r[34]-cross-signed.pem \
+ certs/lets-encrypt-e[12].pem
+ mkdir -pv -- $(BUILDDIR)/certs
+ cat $^ >$@
prefix ?= $(DESTDIR)
exec_prefix ?= $(prefix)
bindir ?= $(exec_prefix)/bin
@@ -38,7 +48,7 @@ $(BUILDDIR)/%: %
install: all
install -m0644 -vDt $(sysconfdir)/lacme $(BUILDDIR)/config/*.conf $(BUILDDIR)/snippets/*.conf
install -vd $(sysconfdir)/lacme/lacme-certs.conf.d
- install -m0644 -vDt $(datadir)/lacme certs/lets-encrypt-x[1-4]-cross-signed.pem
+ install -m0644 -vDt $(datadir)/lacme $(BUILDDIR)/certs/*
install -m0755 -vDt $(libexecdir)/lacme $(BUILDDIR)/client $(BUILDDIR)/webserver
install -m0644 -vDt $(man1dir) $(BUILDDIR)/lacme-accountd.1
install -m0644 -vDt $(man8dir) $(BUILDDIR)/lacme.8