diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-11-25 19:58:13 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-11-26 00:16:06 +0100 |
| commit | 51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 (patch) | |
| tree | fbda1d3514a83cf92593e4ced677bde2338cc27f /lacme.8.md | |
| parent | 77844de56889ab441607086b554b111a3e7b03cf (diff) | |
Use upstream certicate chain instead of an hardcoded one.upstream/0.7
This is a breaking change. The certificate indicated by 'CAfile' is no
longer used as is in 'certificate-chain' (along with the leaf cert).
The chain returned by the ACME v2 endpoint is used instead. This allows
for more flexbility with respect to key/CA rotation, cf.
https://letsencrypt.org/2020/11/06/own-two-feet.html and
https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018
Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt
which is a concatenation of all known active CA certificates (which
includes the previous default).
Diffstat (limited to 'lacme.8.md')
| -rw-r--r-- | lacme.8.md | 13 |
1 files changed, 5 insertions, 8 deletions
@@ -326,9 +326,8 @@ Valid options are: *certificate-chain* -: Where to store the issued certificate, concatenated with the content - of the file specified specified with the *CAfile* option (in PEM - format). +: Where to store the issued certificate along with its chain of trust + (in PEM format). At least one of *certificate* or *certificate-chain* is required. *certificate-key* @@ -350,11 +349,9 @@ Valid options are: *CAfile* -: Path to the issuer's certificate. This is used for - *certificate-chain* and to verify the validity of each issued - certificate. - Specifying an empty value skip certificate validation. - Default: `@@datadir@@/lacme/lets-encrypt-x3-cross-signed.pem`. +: Path to trusted issuer certificates, used for validating each issued + certificate. Specifying an empty values skips certificate validation. + Default: `@@datadir@@/lacme/ca-certificates.crt`. *hash* |