From 2c1a396728a381685923f7b1c4dea53d225112fc Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Sun, 14 Feb 2021 22:59:11 +0100 Subject: Add (self-signed) ISRG Roots to the CA bundle. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This allows us to fully validate provided X.509 chains using that self-contained bundle, regardless of which CAs is marqued as trusted under /etc/ssl/certs. Also, remove cross-signed intermediate CAs from the bundle as they're useless in a self-contained bundle. Also, remove decomissioned intermediate CAs Authority X3 and X4 from the bundle. This change bumps the minimum OpenSSL version to 1.1.0 (for verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options). --- INSTALL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'INSTALL') diff --git a/INSTALL b/INSTALL index a0fcb72..9ecb1bf 100644 --- a/INSTALL +++ b/INSTALL @@ -16,7 +16,7 @@ the following command: apt-get install libconfig-tiny-perl libcrypt-openssl-rsa-perl libcrypt-openssl-bignum-perl libjson-perl -lacme depends on OpenSSL and the following Perl modules: +lacme depends on OpenSSL ≥1.1.0 and the following Perl modules: - Config::Tiny - Digest::SHA (core module) -- cgit v1.2.3