From 2c1a396728a381685923f7b1c4dea53d225112fc Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 14 Feb 2021 22:59:11 +0100
Subject: Add (self-signed) ISRG Roots to the CA bundle.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows us to fully validate provided X.509 chains using that
self-contained bundle, regardless of which CAs is marqued as trusted
under /etc/ssl/certs.

Also, remove cross-signed intermediate CAs from the bundle as they're
useless in a self-contained bundle.

Also, remove decomissioned intermediate CAs Authority X3 and X4 from the
bundle.

This change bumps the minimum OpenSSL version to 1.1.0 (for
verify(1ssl)'s ‘-trusted’ and ‘-show_chain’ options).
---
 Makefile | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

(limited to 'Makefile')

diff --git a/Makefile b/Makefile
index afc5c71..fa830c4 100644
--- a/Makefile
+++ b/Makefile
@@ -13,13 +13,12 @@ $(MANUAL_FILES): $(BUILDDIR)/%: $(BUILDDIR)/%.md
 
 # used for validation, see https://letsencrypt.org/certificates/
 $(BUILDDIR)/certs/ca-certificates.crt: \
-        certs/letsencryptauthorityx[34].pem \
-        certs/lets-encrypt-x[34]-cross-signed.pem \
+        certs/isrgrootx1.pem \
+        certs/isrg-root-x2.pem \
         certs/lets-encrypt-r[34].pem \
-        certs/lets-encrypt-r[34]-cross-signed.pem \
         certs/lets-encrypt-e[12].pem
 	mkdir -pv -- $(BUILDDIR)/certs
-	cat $^ >$@
+	cat -- $^ >$@
 
 prefix ?= $(DESTDIR)
 exec_prefix ?= $(prefix)
-- 
cgit v1.2.3