Add (self-signed) ISRG Roots to the CA bundle.

This allows us to fully validate provided X.509 chains using that
self-contained bundle, regardless of which CAs is marqued as trusted
under /etc/ssl/certs.

Also, remove cross-signed intermediate CAs from the bundle as they're
useless in a self-contained bundle.

Also, remove decomissioned intermediate CAs Authority X3 and X4 from the
bundle.

This change bumps the minimum OpenSSL version to 1.1.0 (for
verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options).

1 files changed, 11 insertions, 7 deletions

diff --git a/lacme b/lacme
index 7ad7aa8..480778f 100755
--- a/lacme
+++ b/lacme
@@ -784,13 +784,17 @@ elsif ($COMMAND eq 'newOrder' or $COMMAND eq 'new-cert') {
             next;
         };
 
-        # verify certificate validity against the CA
-        $conf->{CAfile} //= '@@datadir@@/lacme/ca-certificates.crt';
-        if ($conf->{CAfile} ne '' and spawn({in => $x509}, 'openssl', 'verify', '-CAfile', $conf->{CAfile},
-                                                                      qw/-purpose sslserver -x509_strict/)) {
-            print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n";
-            $rv = 1;
-            next;
+        # verify certificate validity against the CA bundle
+        if ((my $CAfile = $conf->{CAfile} // '@@datadir@@/lacme/ca-certificates.crt') ne '') {
+            my %args = (in => $x509);
+            $args{out} = \*STDERR if $OPTS{debug};
+            my @options = ('-trusted', $CAfile, '-purpose', 'sslserver', '-x509_strict');
+            push @options, '-show_chain' if $OPTS{debug};
+            if (spawn(\%args, 'openssl', 'verify', @options)) {
+                print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n";
+                $rv = 1;
+                next;
+            }
         }
 
         # install certificate