From 51369e3955cdc5bf3f1ba0f6e2d7c4d73406c111 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Wed, 25 Nov 2020 19:58:13 +0100
Subject: Use upstream certicate chain instead of an hardcoded one.

This is a breaking change.  The certificate indicated by 'CAfile' is no
longer used as is in 'certificate-chain' (along with the leaf cert).
The chain returned by the ACME v2 endpoint is used instead.  This allows
for more flexbility with respect to key/CA rotation, cf.
https://letsencrypt.org/2020/11/06/own-two-feet.html and
https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018

Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt
which is a concatenation of all known active CA certificates (which
includes the previous default).
---
 Makefile | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'Makefile')

diff --git a/Makefile b/Makefile
index 757a581..a4098de 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@ DESTDIR ?= /usr/local
 BUILDDIR ?= ./build
 MANUAL_FILES = $(addprefix $(BUILDDIR)/,$(patsubst ./%.md,%,$(wildcard ./*.[1-9].md)))
 
-all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard config/* snippets/*))
+all: manual $(addprefix $(BUILDDIR)/,lacme lacme-accountd client webserver $(wildcard certs/* config/* snippets/*) certs/ca-certificates.crt)
 doc: manual
 
 manual: $(MANUAL_FILES)
@@ -11,6 +11,16 @@ manual: $(MANUAL_FILES)
 $(MANUAL_FILES): $(BUILDDIR)/%: $(BUILDDIR)/%.md
 	pandoc -f markdown -t json -- "$<" | ./pandoc2man.jq | pandoc -s -f json -t man -o "$@"
 
+# used for validation, see https://letsencrypt.org/certificates/
+$(BUILDDIR)/certs/ca-certificates.crt: \
+        certs/letsencryptauthorityx[34].pem \
+        certs/lets-encrypt-x[34]-cross-signed.pem \
+        certs/lets-encrypt-r[34].pem \
+        certs/lets-encrypt-r[34]-cross-signed.pem \
+        certs/lets-encrypt-e[12].pem
+	mkdir -pv -- $(BUILDDIR)/certs
+	cat $^ >$@
+
 prefix ?= $(DESTDIR)
 exec_prefix ?= $(prefix)
 bindir ?= $(exec_prefix)/bin
@@ -38,7 +48,7 @@ $(BUILDDIR)/%: %
 install: all
 	install -m0644 -vDt $(sysconfdir)/lacme $(BUILDDIR)/config/*.conf $(BUILDDIR)/snippets/*.conf
 	install -vd $(sysconfdir)/lacme/lacme-certs.conf.d
-	install -m0644 -vDt $(datadir)/lacme certs/lets-encrypt-x[1-4]-cross-signed.pem
+	install -m0644 -vDt $(datadir)/lacme $(BUILDDIR)/certs/*
 	install -m0755 -vDt $(libexecdir)/lacme $(BUILDDIR)/client $(BUILDDIR)/webserver
 	install -m0644 -vDt $(man1dir) $(BUILDDIR)/lacme-accountd.1
 	install -m0644 -vDt $(man8dir) $(BUILDDIR)/lacme.8
-- 
cgit v1.2.3