From 51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 25 Nov 2020 19:58:13 +0100 Subject: Use upstream certicate chain instead of an hardcoded one. This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default). --- Changelog | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'Changelog') diff --git a/Changelog b/Changelog index b71cce7..13db236 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,17 @@ +lacme (0.7) upstream; + + * Breaking change: the certificate indicated by 'CAfile' is no longer + used as is in 'certificate-chain' (along with the leaf cert). The + chain returned by the ACME v2 endpoint is used instead. This allows + for more flexibility with respect to key/CA rotation, cf. + https://letsencrypt.org/2020/11/06/own-two-feet.html and + https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 + + 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which + is a concatenation of all known active CA certificates (which + includes the previous default). + + -- Guilhem Moulin Wed, 25 Nov 2020 23:39:39 +0100 + lacme (0.6.1) upstream; + Adapt Apache2 snippet to Apache2 2.4. -- cgit v1.2.3