From f2514b36b8c9f519452106fbc84ca69f1955ada1 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 26 Nov 2020 01:19:45 +0100 Subject: Use upstream certificate chain instead of an hardcoded one. This is a breaking change. The certificate indicated by 'CAfile' is no longer used as is in 'certificate-chain' (along with the leaf cert). The chain returned by the ACME v2 endpoint is used instead. This allows for more flexbility with respect to key/CA rotation, cf. https://letsencrypt.org/2020/11/06/own-two-feet.html and https://community.letsencrypt.org/t/beginning-issuance-from-r3/139018 Moreover 'CAfile' now defaults to @@datadir@@/lacme/ca-certificates.crt which is a concatenation of all known active CA certificates (which includes the previous default). --- debian/lacme.install | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'debian/lacme.install') diff --git a/debian/lacme.install b/debian/lacme.install index 303c121..220097d 100644 --- a/debian/lacme.install +++ b/debian/lacme.install @@ -1,4 +1,5 @@ -certs/lets-encrypt-x[1-4]-cross-signed.pem /usr/share/lacme +certs/*.pem /usr/share/lacme +/usr/share/lacme/ca-certificates.crt client webserver /usr/lib/lacme config/lacme-certs.conf config/lacme.conf /etc/lacme lacme /usr/sbin -- cgit v1.2.3