aboutsummaryrefslogtreecommitdiffstats
path: root/letsencrypt
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2016-03-27 18:16:23 +0300
committerGuilhem Moulin <guilhem@fripost.org>2016-03-27 18:16:23 +0300
commitca9c10c262b62eb44031f749c2911031eebe1b45 (patch)
tree06ce8eee03869062f5ca62ad3a62532c145f5385 /letsencrypt
parent61d43f4e017f1eb02cff14987394b1d6a18f9c5f (diff)
parentdb187455ab02d725149a2ce0d5b9b1fb23d1de3c (diff)
Merge branch 'master' into debian
Diffstat (limited to 'letsencrypt')
-rwxr-xr-xletsencrypt6
1 files changed, 3 insertions, 3 deletions
diff --git a/letsencrypt b/letsencrypt
index 23659d5..d11b569 100755
--- a/letsencrypt
+++ b/letsencrypt
@@ -410,6 +410,8 @@ sub acme_client($@) {
die "connect: $!";
}
+ # use execve(2) rather than a Perl pseudo-process to ensure that the
+ # child doesn't have access to the parent's memory
my @fileno = map { fileno($_) =~ /^(\d+)$/ ? $1 : die } ($CONFFILE, $client); # untaint fileno
spawn({%$args{qw/in out/}, child => sub() {
drop_privileges($conf->{user}, $conf->{group}, $args->{chdir} // '/');
@@ -448,8 +450,6 @@ sub spawn($@) {
} else {
open STDOUT, '>', '/dev/null' or die "Can't open /dev/null: $!";
}
- # use execve(2) rather than a Perl pseudo-process to ensure that
- # the child doesn't have access to the parent's memory
exec { $exec[0] } @exec or die;
}
push @CLEANUP, sub() {
@@ -604,7 +604,7 @@ elsif ($COMMAND eq 'new-cert') {
};
# verify certificate validity against the CA
- $conf->{CAfile} //= '/usr/share/letsencrypt-tiny/lets-encrypt-x1-cross-signed.pem';
+ $conf->{CAfile} //= '/usr/share/letsencrypt-tiny/lets-encrypt-x3-cross-signed.pem';
if ($conf->{CAfile} ne '' and spawn({in => $x509}, 'openssl', 'verify', '-CAfile', $conf->{CAfile},
qw/-purpose sslserver -x509_strict/)) {
print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n";