From f2514b36b8c9f519452106fbc84ca69f1955ada1 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 26 Nov 2020 01:19:45 +0100 Subject: Use upstream certificate chain instead of an hardcoded one. This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default). --- debian/changelog | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'debian/changelog') diff --git a/debian/changelog b/debian/changelog index 3366d21..a643159 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,26 @@ +lacme (0.5-1+deb10u2) buster; urgency=medium + + * Use upstream certificate chain instead of an hardcoded one. + This is a breaking change. The certificate indicated by 'CAfile' is no + longer used as is in 'certificate-chain' (along with the leaf cert). + The chain returned by the ACME v2 endpoint is used instead. This allows + for more flexbility with respect to key/CA rotation, cf. + https://letsencrypt.org/2020/11/06/own-two-feet.html and + https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 + * Additional current/planned CA certificates can be found under + /usr/local/share/lacme: + - lets-encrypt-e[12].pem + - lets-encrypt-r[34]-cross-signed.pem + - lets-encrypt-r[34].pem + - letsencryptauthorityx[34].pem + See https://letsencrypt.org/certificates/ + * Moreover 'CAfile' now defaults to /usr/share/lacme/ca-certificates.crt + which is a concatenation of all known active CA certificates (which + includes the previous default). + Closes: #975862. + + -- Guilhem Moulin Thu, 26 Nov 2020 01:14:50 +0100 + lacme (0.5-1+deb10u1) buster; urgency=medium * Link to RFC 8555 instead of the -- cgit v1.2.3