aboutsummaryrefslogtreecommitdiffstats
path: root/debian/lacme.install
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2020-11-26 01:19:45 +0100
committerGuilhem Moulin <guilhem@fripost.org>2020-11-26 02:10:05 +0100
commitf2514b36b8c9f519452106fbc84ca69f1955ada1 (patch)
tree309441147d3810d17f8b2694933e068c80a9e07d /debian/lacme.install
parentaa779d1f1658a1244e2cba03b07ea9be3c4ee2a0 (diff)
Use upstream certificate chain instead of an hardcoded one.debian/0.5-1+deb10u2debian/buster
This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default).
Diffstat (limited to 'debian/lacme.install')
-rw-r--r--debian/lacme.install3
1 files changed, 2 insertions, 1 deletions
diff --git a/debian/lacme.install b/debian/lacme.install
index 303c121..220097d 100644
--- a/debian/lacme.install
+++ b/debian/lacme.install
@@ -1,4 +1,5 @@
-certs/lets-encrypt-x[1-4]-cross-signed.pem /usr/share/lacme
+certs/*.pem /usr/share/lacme
+/usr/share/lacme/ca-certificates.crt
client webserver /usr/lib/lacme
config/lacme-certs.conf config/lacme.conf /etc/lacme
lacme /usr/sbin