aboutsummaryrefslogtreecommitdiffstats
path: root/debian/lacme.NEWS
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2020-11-26 00:14:20 +0100
committerGuilhem Moulin <guilhem@fripost.org>2020-11-26 00:18:32 +0100
commit4e0a55fb382a5ce33912643ec07b59800d497f23 (patch)
treefc5ad90e40babe2f66255f76c0f157867c5d235e /debian/lacme.NEWS
parentc3cce44cfc175b9ac641820c63354ade12fb05b5 (diff)
New upstream release.debian/0.7-1
Closes: #975862.
Diffstat (limited to 'debian/lacme.NEWS')
-rw-r--r--debian/lacme.NEWS16
1 files changed, 16 insertions, 0 deletions
diff --git a/debian/lacme.NEWS b/debian/lacme.NEWS
new file mode 100644
index 0000000..d20acdc
--- /dev/null
+++ b/debian/lacme.NEWS
@@ -0,0 +1,16 @@
+lacme (0.7-1) unstable; urgency=high
+
+ The certificate indicated by 'CAfile' is no longer used as is in
+ 'certificate-chain' (along with the leaf cert). The chain returned
+ by the ACME v2 endpoint is used instead. This allows for more
+ flexibility with respect to key/CA rotation. See for instance
+ https://letsencrypt.org/2020/11/06/own-two-feet.html and
+ https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018
+
+ 'CAfile' now defaults to /usr/share/lacme/ca-certificates.crt which
+ is a concatenation of all known active CA certificates (which
+ includes the previous default). Starting December 2020 Let's Encrypt
+ will use a different chain of trust for certificate issuance, so
+ users will a non-default 'CAfile' might need to adjust the value.
+
+ -- Guilhem Moulin <guilhem@debian.org> Thu, 26 Nov 2020 00:08:32 +0100