diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-11-26 01:19:45 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-11-26 02:10:05 +0100 |
| commit | f2514b36b8c9f519452106fbc84ca69f1955ada1 (patch) | |
| tree | 309441147d3810d17f8b2694933e068c80a9e07d /debian/patches/series | |
| parent | aa779d1f1658a1244e2cba03b07ea9be3c4ee2a0 (diff) | |
Use upstream certificate chain instead of an hardcoded one.debian/0.5-1+deb10u2debian/buster
This is a breaking change. The certificate indicated by 'CAfile' is no
longer used as is in 'certificate-chain' (along with the leaf cert).
The chain returned by the ACME v2 endpoint is used instead. This allows
for more flexbility with respect to key/CA rotation, cf.
https://letsencrypt.org/2020/11/06/own-two-feet.html and
https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018
Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt
which is a concatenation of all known active CA certificates (which
includes the previous default).
Diffstat (limited to 'debian/patches/series')
| -rw-r--r-- | debian/patches/series | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/debian/patches/series b/debian/patches/series index ddf7cce..fcf1c3f 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ 0001-Mention-the-Debian-BTS-in-the-manpages.patch 0002-Issue-GET-and-POST-as-GET-requests.patch +0003-Use-upstream-certicate-chain-instead-of-an-hardcoded.patch |