--- /dev/null	Fri Jun 15 16:18:43 2012
+++ new/usr/src/cmd/certsdir/Makefile	Fri Jun 15 16:18:43 2012
@@ -0,0 +1,46 @@
+#
+# This file and its contents are supplied under the terms of the
+# Common Development and Distribution License ("CDDL"), version 1.0.
+# You may only use this file in accordance with the terms of version
+# 1.0 of the CDDL.
+#
+# A full copy of the text of the CDDL should have accompanied this
+# source.  A copy of the CDDL is also available via the Internet at
+# http://www.illumos.org/license/CDDL.
+#
+
+#
+# Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+#
+PROG=		certsdir
+
+OBJS=		certsdir.o utils.o scf.o
+SRCS=	 	$(OBJS:%.o=%.c)
+
+include ../Makefile.cmd
+
+FILEMODE =	0555
+
+MANIFEST =		certsdir.xml
+ROOTMANIFESTDIR =	$(ROOTSVCSYSTEM)
+
+LDLIBS +=	-lscf
+
+.KEEP_STATE:
+
+.PARALLEL: $(OBJS)
+
+all:		$(PROG) 
+
+$(PROG):	$(OBJS)
+	$(LINK.c) $(OBJS) -o $@ $(LDLIBS)
+	$(POST_PROCESS)
+
+install: all .WAIT $(ROOTLIBPROG) $(ROOTMANIFEST)
+
+lint: 	lint_SRCS
+
+clean:
+	$(RM) $(OBJS)
+
+include ../Makefile.targ
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/certsdir.c	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,455 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <errno.h>
+#include <unistd.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <err.h>
+#include <locale.h>
+#include <libintl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <stddef.h>
+#include <libscf.h>
+
+#include "utils.h"
+#include "scf.h"
+
+#ifndef	TEXT_DOMAIN
+#define	TEXT_DOMAIN	"SYS_TEST"
+#endif
+
+#define	_(x)	gettext(x)
+
+#define	CERTS_FILE_DIR	"/etc/certs/CA"
+#define	CERTS_LINK_DIR	"/etc/openssl/certs"
+
+#define	OPENSSL	"/usr/bin/openssl"
+
+#define	FMT_VERSION	"OpenSSL Version: %s (%s)\n"
+#define	MSG_OLD_HASH	"supports old hash only"
+#define	MSG_NEW_HASH	"supports new hashes"
+
+#define	FMT_WRONG	"WRONG: [%s] -> %s\n  should be: %s\n"
+#define	FMT_MISSING	"MISSING: [%s] -> %s\n"
+#define	FMT_DANGLING	"DANGLING: [%s] -> %s\n"
+#define	FMT_UNKNOWN	"UNKNOWN TARGET: [%s] -> %s\n"
+
+#define	MAX_HASHES 2
+
+typedef struct cert_file {
+	char *path;
+	char *hash[MAX_HASHES];
+	uint8_t hashcnt;
+
+	struct cert_file *next;
+} cert_file_t;
+
+typedef struct cert_link {
+	char *path;
+	char *hash;
+	uint8_t targetfound;
+
+	struct cert_link *next;
+} cert_link_t;
+
+/* configuration from smf(5) */
+static char *certs_file_dir = CERTS_FILE_DIR;
+static char *certs_link_dir = CERTS_LINK_DIR;
+static char *openssl = OPENSSL;
+static int verbose = B_FALSE;
+static boolean_t remove_dangling = B_TRUE;
+static boolean_t remove_unknown = B_FALSE;
+static boolean_t create_missing = B_TRUE;
+static boolean_t correct_wrong = B_TRUE;
+
+/* list heads */
+static cert_file_t *file0 = NULL;
+static cert_link_t *link0 = NULL;
+
+#define	OP_HASH		0
+#define	OP_VERSION	1
+#define	OP_HASH_OLD	2
+#define	NUM_OPS		3
+char *
+run_openssl(unsigned int op, char *arg)
+{
+	pid_t pid;
+	int des[2];
+	int i;
+	ssize_t num;
+	char buf[500];
+	int status;
+
+	if (op >= NUM_OPS)
+		abort();
+
+	(void) pipe(des);
+	switch (pid = fork()) {
+	case -1: /* error */
+		err(SMF_EXIT_ERR_FATAL, _("forking child for openssl"));
+		break;
+	case 0: /* child */
+		(void) close(des[0]);
+		if (dup2(des[1], STDOUT_FILENO) == -1 || dup2(des[1],
+		    STDERR_FILENO) == -1)
+			err(100, NULL);
+		(void) close(STDIN_FILENO);
+		switch (op) {
+		case OP_HASH:
+			execlp(openssl, openssl, "x509", "-hash",
+			    "-noout", "-in", arg, (char *)0);
+			break;
+		case OP_VERSION:
+			execlp(openssl, openssl, "version", (char *)0);
+			break;
+		case OP_HASH_OLD:
+			execlp(openssl, openssl, "x509",
+			    "-subject_hash_old", "-noout", "-in",
+			    arg, (char *)0);
+			break;
+		}
+		printf(_("exec openssl failed: %s\n"), strerror(errno));
+		exit(SMF_EXIT_ERR_FATAL);
+		break;
+	default: /* parent */
+		(void) close(des[1]);
+		num = read(des[0], &buf, sizeof (buf));
+		(void) close(des[0]);
+
+		if (num < 0)
+			err(101, _("reading from openssl child"));
+
+		buf[num] = 0;
+		for (i = 0; i < num; i++) {
+			if (buf[i] == '\n' || buf[i] == '\r') {
+				buf[i] = 0;
+				break;
+			}
+		}
+
+		if (waitpid(pid, &status, 0) == -1 || !WIFEXITED(status))
+			err(SMF_EXIT_ERR_FATAL,
+			    _("waiting for openssl child"));
+		if (WEXITSTATUS(status) != 0)
+			errx(SMF_EXIT_ERR_FATAL,
+			    _("error from openssl child (rc: %d): %s"),
+			    WEXITSTATUS(status), buf);
+
+		return (xstrdup(buf));
+	}
+}
+
+int newossl = 0;
+
+
+void
+detect_openssl(void)
+{
+	char *vers;
+
+	/* determine openssl version */
+	vers = run_openssl(OP_VERSION, NULL);
+	if (strstr(vers, "OpenSSL 1.") == vers)
+		newossl = 1;
+	else if (strstr(vers, "OpenSSL 0.9.") != vers)
+		errx(SMF_EXIT_ERR_FATAL, _("unrecognised OpenSSL: %s"), vers);
+	if (verbose)
+		printf(_(FMT_VERSION), vers, (newossl ? _(MSG_NEW_HASH) :
+		    _(MSG_OLD_HASH)));
+	free(vers);
+}
+
+void
+store_certlink(cert_link_t *cd)
+{
+	if (link0 == NULL) {
+		link0 = cd;
+	} else {
+		cert_link_t *t = link0;
+		while (t->next != NULL)
+			t = t->next;
+		t->next = cd;
+	}
+}
+
+cert_link_t *
+find_link_by_hash(char *hash)
+{
+	cert_link_t *t = link0;
+	while (t != NULL) {
+		if (strcmp(t->hash, hash) == 0)
+			return (t);
+		t = t->next;
+	}
+	return (NULL);
+}
+
+void
+store_certfile(cert_file_t *cs)
+{
+	if (file0 == NULL) {
+		file0 = cs;
+	} else {
+		cert_file_t *t = file0;
+		while (t->next != NULL)
+			t = t->next;
+		t->next = cs;
+	}
+}
+
+char *
+add_dot_zero(char *str)
+{
+	char *ret;
+	xasprintf(&ret, "%s.0", str);
+	free(str);
+	return (ret);
+}
+
+void
+populate_hash_list(cert_file_t *cs)
+{
+	if (cs->path[0] != '/')
+		abort();
+
+	if (newossl)
+		cs->hash[cs->hashcnt++] =
+		    add_dot_zero(run_openssl(OP_HASH_OLD, cs->path));
+	cs->hash[cs->hashcnt++] = add_dot_zero(run_openssl(OP_HASH, cs->path));
+}
+
+void
+get_cert_file_list(void)
+{
+	DIR *dir;
+	struct dirent *de;
+
+	dir = opendir(certs_file_dir);
+	if (dir == NULL)
+		err(SMF_EXIT_ERR_FATAL, _("could not read directory %s"),
+		    certs_file_dir);
+
+	for (de = readdir(dir); de != NULL; de = readdir(dir)) {
+		char *a;
+		cert_file_t *cs;
+
+		if (strcmp(".", de->d_name) == 0 ||
+		    strcmp("..", de->d_name) == 0)
+			continue;
+
+		cs = xmalloc(sizeof (*cs));
+		xasprintf(&a, "%s/%s", certs_file_dir, de->d_name);
+		cs->path = xrealpath(a);
+		free(a);
+		populate_hash_list(cs);
+		store_certfile(cs);
+	}
+	(void) closedir(dir);
+}
+
+void
+removehashlink(char *hash)
+{
+	char *fqhash;
+	xasprintf(&fqhash, "%s/%s", certs_link_dir, hash);
+	xunlink(fqhash);
+	free(fqhash);
+}
+
+void
+fixhashlink(char *file, char *hash)
+{
+	char *fqhash;
+	char *relfile;
+
+	xasprintf(&fqhash, "%s/%s", certs_link_dir, hash);
+	relfile = xmakerelative(certs_link_dir, file);
+
+	if (xexists(fqhash))
+		xunlink(fqhash);
+
+	if (symlink(relfile, fqhash) != 0)
+		err(SMF_EXIT_ERR_FATAL, _("could not create symlink %s"),
+		    fqhash);
+
+	free(fqhash);
+	free(relfile);
+}
+
+void
+get_cert_link_list(void)
+{
+	DIR *dir;
+	struct dirent *de;
+
+	dir = opendir(certs_link_dir);
+	if (dir == NULL)
+		err(SMF_EXIT_ERR_FATAL, _("could not read directory %s"),
+		    certs_link_dir);
+
+	for (de = readdir(dir); de != NULL; de = readdir(dir)) {
+		cert_link_t *cd;
+		char *a, *b;
+
+		if (strcmp(".", de->d_name) == 0 ||
+		    strcmp("..", de->d_name) == 0)
+			continue;
+
+		cd = xmalloc(sizeof (*cd));
+
+		cd->hash = xstrdup(de->d_name);
+
+		xasprintf(&a, "%s/%s", certs_link_dir, de->d_name);
+		b = xreadlink(a);
+		free(a);
+		if (b[0] == '.') {
+			xasprintf(&a, "%s/%s", certs_link_dir, b);
+			free(b);
+			b = a;
+		}
+		a = xrealpath(b);
+		free(b);
+		cd->path = a;
+
+		store_certlink(cd);
+	}
+	(void) closedir(dir);
+}
+
+void
+read_config(void)
+{
+	int a;
+	char *b;
+
+	a = get_config_boolean("verbose");
+	if (a >= 0)
+		verbose = a;
+	a = get_config_boolean("remove_dangling");
+	if (a >= 0)
+		remove_dangling = a;
+	a = get_config_boolean("remove_unknown");
+	if (a >= 0)
+		remove_unknown = a;
+	a = get_config_boolean("create_missing");
+	if (a >= 0)
+		create_missing = a;
+	a = get_config_boolean("correct_wrong");
+	if (a >= 0)
+		correct_wrong = a;
+
+	b = get_config_string("certs_file_dir");
+	if (b != NULL)
+		certs_file_dir = b;
+	b = get_config_string("certs_link_dir");
+	if (b != NULL)
+		certs_link_dir = b;
+	b = get_config_string("openssl_command");
+	if (b != NULL)
+		openssl = b;
+}
+
+
+int
+main(void)
+{
+	cert_file_t *tf;
+	cert_link_t *tl;
+
+	(void) setlocale(LC_ALL, "");
+	(void) textdomain(TEXT_DOMAIN);
+
+	if (init_scf() != 0)
+		errx(SMF_EXIT_ERR_FATAL, _("could not connect to smf(5): %s"),
+		    scf_strerror(scf_error()));
+	read_config();
+	fini_scf();
+
+#ifdef	DEBUG
+	verbose = B_TRUE;
+#endif
+
+	detect_openssl();
+
+	get_cert_link_list();
+	get_cert_file_list();
+
+	/*
+	 * look at each certificate file and determine if there is
+	 * a symlink to it in the link directory
+	 */
+	for (tf = file0; tf != NULL; tf = tf->next) {
+		int j;
+		for (j = 0; j < tf->hashcnt; j++) {
+			tl = find_link_by_hash(tf->hash[j]);
+			if (tl) {
+				tl->targetfound = 1;
+				if (correct_wrong && strcmp(tl->path, tf->path)
+				    != 0) {
+					if (verbose)
+						printf(_(FMT_WRONG),
+						    tf->hash[j], tl->path,
+						    tf->path);
+					fixhashlink(tf->path, tf->hash[j]);
+				}
+			} else if (create_missing) {
+				if (verbose)
+					printf(_(FMT_MISSING), tf->hash[j],
+					    tf->path);
+				fixhashlink(tf->path, tf->hash[j]);
+			}
+		}
+	}
+	/*
+	 * look at each certificate link and determine if it's dangling or
+	 * pointing to a certificate file which we haven't seen
+	 */
+	for (tl = link0; tl != NULL; tl = tl->next) {
+		if (!xexists(tl->path)) {
+			if (remove_dangling) {
+				if (verbose)
+					printf(_(FMT_DANGLING), tl->hash,
+					    tl->path);
+				removehashlink(tl->hash);
+			}
+		} else if (!tl->targetfound) {
+			if (remove_unknown) {
+				if (verbose)
+					printf(_(FMT_UNKNOWN), tl->hash,
+					    tl->path);
+				removehashlink(tl->hash);
+			}
+		}
+	}
+
+	return (0);
+}
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/certsdir.xml	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,105 @@
+<?xml version="1.0"?>
+<!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
+<!--
+ Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+
+ CDDL HEADER START
+
+ The contents of this file are subject to the terms of the
+ Common Development and Distribution License (the "License").
+ You may not use this file except in compliance with the License.
+
+ You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ or http://www.opensolaris.org/os/licensing.
+ See the License for the specific language governing permissions
+ and limitations under the License.
+
+ When distributing Covered Code, include this CDDL HEADER in each
+ file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ If applicable, add the following below this CDDL HEADER, with the
+ fields enclosed by brackets "[]" replaced with your own identifying
+ information: Portions Copyright [yyyy] [name of copyright owner]
+
+ CDDL HEADER END
+
+	NOTE:  This service manifest is not editable; its contents will
+	be overwritten by package or patch operations, including
+	operating system upgrade.  Make customizations in a different
+	file.
+-->
+
+<service_bundle type='manifest' name='crypto-ca-certificates:certsdir'>
+
+<service
+	name='system/certsdir'
+	type='service'
+	version='1'>
+
+	<create_default_instance enabled='true' />
+
+	<single_instance />
+
+	<dependency
+		name='filesystem-minimal'
+		type='service'
+		grouping='require_all'
+		restart_on='none'>
+		<service_fmri value='svc:/system/filesystem/minimal' />
+	</dependency>
+
+	<exec_method
+		type='method'
+		name='start'
+		exec='/usr/lib/certsdir'
+		timeout_seconds='60' />
+
+	<exec_method
+		type='method'
+		name='stop'
+		exec=':true'
+		timeout_seconds='0' />
+
+	<exec_method
+		type='method'
+		name='refresh'
+		exec='/usr/lib/certsdir'
+		timeout_seconds='60' />
+
+	<property_group name='startd' type='framework'>
+		<propval name='duration' type='astring' value='transient' />
+	</property_group>
+
+	<property_group name='config' type='application'>
+		<propval name='verbose' type='boolean' value='false' />
+		<!-- remove symlinks from the link directory that
+		     point to non-existent files: -->
+		<propval name='remove_dangling' type='boolean' value='true' />
+		<!-- remove symlinks from the link directory that
+		     point to files from somewhere outside the CA file directory -->
+		<propval name='remove_unknown' type='boolean' value='false' />
+		<!-- create symlinks to files from the CA file directory that
+		     are missing from the link directory -->
+		<propval name='create_missing' type='boolean' value='true' />
+		<!-- recreate symlinks for files from the CA file directory that
+		     are linked with an incorrect hash in the link directory -->
+		<propval name='correct_wrong' type='boolean' value='true' />
+		<!-- the directory with CA certificate files -->
+		<propval name='certs_file_dir' type='astring' value='/etc/certs/CA' />
+		<!-- the directory with OpenSSL certificate hash symlinks -->
+		<propval name='certs_link_dir' type='astring' value='/etc/openssl/certs' />
+		<!-- the OpenSSL binary to use -->
+		<propval name='openssl' type='astring' value='/usr/bin/openssl' />
+	</property_group>
+
+	<stability value='Unstable' />
+
+	<template>
+		<common_name>
+			<loctext xml:lang='C'>
+certsdir: OpenSSL certificates directory symlink populator
+			</loctext>
+		</common_name>
+	</template>
+</service>
+
+</service_bundle>
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/scf.c	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,212 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <err.h>
+#include <limits.h>
+#include <libscf.h>
+
+#include "utils.h"
+#include "scf.h"
+
+static char *fmri;
+static scf_handle_t *scf;
+static scf_instance_t *inst;
+static scf_propertygroup_t *pg;
+
+/*
+ * Initialise our connection to smf(5).  Returns:
+ *    0 on success
+ *   <0 for any failure
+ *   -2 if we believe we're not actually running under smf(5)
+ */
+int
+init_scf(void)
+{
+	int rc = -1;
+	int fmrisz;
+
+	scf = scf_handle_create(SCF_VERSION);
+	if (scf == NULL)
+		return (-1);
+	if (scf_handle_bind(scf) != 0)
+		goto cleanup0;
+
+	if (getenv("SMF_TEST_FMRI") != NULL) {
+		fprintf(stderr, "DEBUG: smf test mode engaged\n");
+		fmri = strdup(getenv("SMF_TEST_FMRI"));
+		goto have_fmri;
+	}
+
+	fmrisz = scf_myname(scf, NULL, 0);
+	if (fmrisz == -1) {
+		if (scf_error() == SCF_ERROR_NOT_SET) {
+			rc = -2;
+		}
+		goto cleanup1;
+	}
+	fmri = xmalloc(fmrisz + 1);
+	fmrisz = scf_myname(scf, fmri, fmrisz + 1);
+	if (fmrisz == -1)
+		goto cleanup2;
+
+have_fmri:
+
+	if ((inst = scf_instance_create(scf)) == NULL ||
+	    (pg = scf_pg_create(scf)) == NULL)
+		goto cleanup3;
+
+	if (scf_handle_decode_fmri(scf, fmri, NULL, NULL, inst,
+	    NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0)
+		goto cleanup3;
+
+	if (scf_instance_get_pg_composed(inst, NULL, "config", pg) != 0)
+		goto cleanup3;
+
+	return (0);
+
+cleanup3:
+	if (pg != NULL) {
+		scf_pg_destroy(pg);
+		pg = NULL;
+	}
+	if (inst != NULL) {
+		scf_instance_destroy(inst);
+		inst = NULL;
+	}
+cleanup2:
+	free(fmri);
+	fmri = NULL;
+cleanup1:
+	(void) scf_handle_unbind(scf);
+cleanup0:
+	(void) scf_handle_destroy(scf);
+	scf = NULL;
+	return (rc);
+}
+
+void
+fini_scf(void)
+{
+	(void) scf_pg_destroy(pg);
+	pg = NULL;
+	(void) scf_instance_destroy(inst);
+	inst = NULL;
+	free(fmri);
+	fmri = NULL;
+	(void) scf_handle_unbind(scf);
+	(void) scf_handle_destroy(scf);
+	scf = NULL;
+}
+
+/*
+ * Fetch the boolean value of a property from the 'config' property
+ * group in our smf(5) instance.
+ * Returns:
+ *   <0 on failure
+ *    0 if found and false
+ *    1 if found and true
+ */
+int
+get_config_boolean(char *name)
+{
+	scf_property_t *prop = NULL;
+	scf_value_t *val = NULL;
+	uint8_t out;
+	int rc = -1;
+
+	prop = scf_property_create(scf);
+	val = scf_value_create(scf);
+	if (prop == NULL || val == NULL)
+		goto cleanup0;
+
+	if (scf_pg_get_property(pg, name, prop) != 0)
+		goto cleanup0;
+
+	if (scf_property_is_type(prop, SCF_TYPE_BOOLEAN) != 0)
+		goto cleanup0;
+
+	if (scf_property_get_value(prop, val) != 0)
+		goto cleanup0;
+
+	if (scf_value_get_boolean(val, &out) != 0)
+		goto cleanup0;
+
+	rc = out;
+
+cleanup0:
+	if (val != NULL)
+		scf_value_destroy(val);
+	if (prop != NULL)
+		scf_property_destroy(prop);
+
+	return (rc);
+}
+
+/*
+ * Fetch the boolean value of a property from the 'config' property
+ * group in our smf(5) instance.
+ * Returns:
+ *   NULL on failure
+ *   a NUL-terminated string value on success, caller to free
+ */
+char *
+get_config_string(char *name)
+{
+	scf_property_t *prop = NULL;
+	scf_value_t *val = NULL;
+	char out[PATH_MAX];
+	char *rc = NULL;
+
+	prop = scf_property_create(scf);
+	val = scf_value_create(scf);
+	if (prop == NULL || val == NULL)
+		goto cleanup0;
+
+	if (scf_pg_get_property(pg, name, prop) != 0)
+		goto cleanup0;
+
+	if (scf_property_is_type(prop, SCF_TYPE_ASTRING) != 0)
+		goto cleanup0;
+
+	if (scf_property_get_value(prop, val) != 0)
+		goto cleanup0;
+
+	if (scf_value_get_astring(val, out, sizeof (out)) == -1)
+		goto cleanup0;
+
+	rc = xstrdup(out);
+
+cleanup0:
+	if (val != NULL)
+		scf_value_destroy(val);
+	if (prop != NULL)
+		scf_property_destroy(prop);
+
+	return (rc);
+}
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/scf.h	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,42 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+ */
+
+#ifndef	_SCF_H
+#define	_SCF_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+int init_scf(void);
+void fini_scf(void);
+int get_config_boolean(char *);
+char *get_config_string(char *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _SCF_H */
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/utils.c	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,182 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+ */
+
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <errno.h>
+#include <unistd.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <err.h>
+#include <libintl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <stddef.h>
+#include <libscf.h>
+
+#include "utils.h"
+
+#define	_(x)	gettext(x)
+
+void *
+xmalloc(size_t sz)
+{
+	void *x = malloc(sz);
+	if (x == NULL)
+		abort();
+	bzero(x, sz);
+	return (x);
+}
+
+char *
+xstrdup(const char *a)
+{
+	char *x = strdup(a);
+	if (x == NULL)
+		abort();
+	return (x);
+}
+
+int
+xasprintf(char **str, const char *format, ...)
+{
+	va_list ap;
+	int ret;
+
+	*str = NULL;
+	va_start(ap, format);
+	ret = vasprintf(str, format, ap);
+	va_end(ap);
+
+	if (ret == -1)
+		abort();
+
+	return (ret);
+}
+
+int
+xexists(char *path)
+{
+	struct stat buf;
+	if (stat(path, &buf) != 0) {
+		if (errno == ENOENT)
+			return (0);
+		else
+			err(SMF_EXIT_ERR_FATAL, _("stat on path: %s"), path);
+	}
+	return (1);
+}
+
+char *
+xreadlink(char *path)
+{
+	char tmp[PATH_MAX];
+	int len;
+
+	len = readlink(path, tmp, sizeof (tmp) - 1);
+	if (len == -1 || len >= (int)sizeof (tmp))
+		err(SMF_EXIT_ERR_FATAL, _("readlink failure on path: %s"),
+		    path);
+	tmp[len] = '\0'; /* NUL-terminate what readlink gives us */
+
+	return (xstrdup(tmp));
+}
+
+char *
+xrealpath(char *path)
+{
+	char *ret;
+	char tmp[PATH_MAX];
+
+	ret = realpath(path, tmp);
+	if (ret == NULL) {
+		if (errno == ENOENT)
+			return (xstrdup(path));
+		else
+			err(SMF_EXIT_ERR_FATAL, _("realpath failure on"
+			    " path: %s"), path);
+	}
+
+	return (xstrdup(tmp));
+}
+
+void
+xunlink(const char *path)
+{
+	if (unlink(path) != 0)
+		err(SMF_EXIT_ERR_FATAL, _("could not unlink: %s"), path);
+}
+
+char *
+xmakerelative(char *relativetodir, char *path)
+{
+	int i;
+	int comlen = 0;
+	int extraelems = 0;
+	char tmp[PATH_MAX];
+	char *lastsrc, *lastpath, *srccomp, *pathcomp;
+	char *trelativetodir = strdup(relativetodir);
+	char *tpath = strdup(path);
+
+	if (relativetodir[0] != '/' || path[0] != '/')
+		abort();
+
+	srccomp = strtok_r(trelativetodir, "/", &lastsrc);
+	pathcomp = strtok_r(tpath, "/", &lastpath);
+
+	/* discard elements common to both paths */
+	while (srccomp != NULL && pathcomp != NULL &&
+	    strcmp(srccomp, pathcomp) == 0) {
+		srccomp = strtok_r(NULL, "/", &lastsrc);
+		pathcomp = strtok_r(NULL, "/", &lastpath);
+	}
+	/* record the start of the unique part of the target path */
+	comlen = pathcomp - tpath;
+	/* count the number of non-common path elements in the target dir */
+	while (srccomp != NULL) {
+		extraelems++;
+		srccomp = strtok_r(NULL, "/", &lastsrc);
+	}
+
+	if (extraelems * 3 + strlen(&path[comlen]) + 1 > PATH_MAX)
+		errx(17, "relative path generation error");
+
+	/*
+	 * generate a path that escapes only the non-common elements of the
+	 * target directory
+	 */
+	tmp[0] = '\0';
+	for (i = 0; i < extraelems; i++)
+		strcat(tmp, "../");
+	strcat(tmp, &path[comlen]);
+
+	free(trelativetodir);
+	free(tpath);
+
+	return (strdup(tmp));
+}
--- /dev/null	Fri Jun 15 16:18:44 2012
+++ new/usr/src/cmd/certsdir/utils.h	Fri Jun 15 16:18:44 2012
@@ -0,0 +1,46 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
+ */
+
+#ifndef	_UTILS_H
+#define	_UTILS_H
+
+#ifdef	__cplusplus
+extern "C" {
+#endif
+
+void *xmalloc(size_t);
+char *xstrdup(const char *);
+int xasprintf(char **, const char *, ...);
+int xexists(char *);
+char *xreadlink(char *);
+char *xrealpath(char *);
+void xunlink(const char *);
+char *xmakerelative(char *, char *);
+
+#ifdef	__cplusplus
+}
+#endif
+
+#endif	/* _UTILS_H */
--- old/usr/src/cmd/cmd-crypto/etc/Makefile.ca-links	Fri Jun 15 16:18:45 2012
+++ new/usr/src/cmd/cmd-crypto/etc/Makefile.ca-links	Fri Jun 15 16:18:45 2012
@@ -176,10 +176,4 @@
 IETCCAFILES +=		$(CAFILES:%=$(ROOTETCCADIR)/%)
 
 $(ROOTETCCADIR)/%:    $(CASRCDIR)/%
-	$(INS.file); \
-	ROOTCALINK=$(ROOTETCCALINKDIR)/`$(OPENSSL) x509 -noout -hash -in $<`.0; \
-	$(RM) $$ROOTCALINK; \
-	$(LN) -s $(CATARGDIR)/$(@F) $$ROOTCALINK
-	-ROOTCALINK=$(ROOTETCCALINKDIR)/`$(OPENSSL) x509 -noout -subject_hash_old -in $< 2>/dev/null`.0; \
-	test "$$ROOTCALINK" = "$(ROOTETCCALINKDIR)/.0" || $(RM) $$ROOTCALINK; \
-	test "$$ROOTCALINK" = "$(ROOTETCCALINKDIR)/.0" || $(LN) -s $(CATARGDIR)/$(@F) $$ROOTCALINK
+	$(INS.file)
--- old/usr/src/pkg/manifests/crypto-ca-certificates.mf	Fri Jun 15 16:18:45 2012
+++ new/usr/src/pkg/manifests/crypto-ca-certificates.mf	Fri Jun 15 16:18:45 2012
@@ -22,6 +22,7 @@
 #
 # Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 # Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved.
+# Copyright 2012 Joshua M. Clulow <josh@sysmgr.org>
 #
 
 set name=pkg.fmri value=pkg:/crypto/ca-certificates@$(PKGVERS)
@@ -37,6 +38,12 @@
 dir path=etc/certs/CA group=sys
 dir path=etc/openssl group=sys
 dir path=etc/openssl/certs group=sys
+dir path=lib
+dir path=lib/svc
+dir path=lib/svc/manifest group=sys
+dir path=lib/svc/manifest/system group=sys
+dir path=usr group=sys
+dir path=usr/lib
 file path=etc/certs/CA/ABAecom_sub.,_Am._Bankers_Assn._Root_CA.pem group=sys
 file path=etc/certs/CA/AOL_Time_Warner_Root_Certification_Authority_1.pem \
     group=sys
@@ -211,556 +218,7 @@
 file path=etc/certs/CA/beTRUSTed_Root_CA_-_RSA_Implementation.pem group=sys
 file path=etc/certs/CA/ePKI_Root_Certification_Authority.pem group=sys
 file path=etc/certs/CA/thawte_Primary_Root_CA.pem group=sys
+file path=lib/svc/manifest/system/certsdir.xml group=sys mode=0444
+file path=usr/lib/certsdir mode=0555
 license cr_Sun license=cr_Sun
 license lic_CDDL license=lic_CDDL
-link path=etc/openssl/certs/00673b5b.0 \
-    target=../../certs/CA/thawte_Primary_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/024dc131.0 \
-    target=../../certs/CA/Microsec_e-Szigno_Root_CA.pem
-link path=etc/openssl/certs/02b73561.0 \
-    target=../../certs/CA/Comodo_Secure_Services_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/039c618a.0 \
-    target=../../certs/CA/TURKTRUST_Certificate_Services_Provider_Root_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/03f0efa4.0 \
-    target=../../certs/CA/Wells_Fargo_Root_CA.pem
-link path=etc/openssl/certs/0481cb65.0 \
-    target=../../certs/CA/AOL_Time_Warner_Root_Certification_Authority_2.pem
-link path=etc/openssl/certs/052e396b.0 \
-    target=../../certs/CA/AddTrust_Qualified_Certificates_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/0750887b.0 \
-    target=../../certs/CA/IPS_CLASE3_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/080911ac.0 \
-    target=../../certs/CA/QuoVadis_Root_CA.pem
-link path=etc/openssl/certs/08aef7bb.0 \
-    target=../../certs/CA/WellsSecure_Public_Root_Certificate_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/09ca81a7.0 \
-    target=../../certs/CA/Thawte_Personal_Premium_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/0a8f0c78.0 \
-    target=../../certs/CA/IPS_Chained_CAs_root.pem
-link path=etc/openssl/certs/0c364b2d.0 \
-    target=../../certs/CA/Entrust.net_Secure_Personal_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/0d1b923b.0 \
-    target=../../certs/CA/S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN.pem
-link path=etc/openssl/certs/0dbd0096.0 \
-    target=../../certs/CA/AOL_Time_Warner_Root_Certification_Authority_1.pem
-link path=etc/openssl/certs/0e82f83a.0 \
-    target=../../certs/CA/Thawte_Personal_Basic_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/0f11b315.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/106cd822.0 \
-    target=../../certs/CA/Verisign_RSA_Secure_Server_CA.pem
-link path=etc/openssl/certs/111e6273.0 \
-    target=../../certs/CA/GlobalSign_Root_CA_-_R2.pem
-link path=etc/openssl/certs/1155c94b.0 \
-    target=../../certs/CA/Firmaprofesional_Root_CA.pem
-link path=etc/openssl/certs/11a09b38.0 \
-    target=../../certs/CA/TDC_OCES_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/11c69ce5.0 \
-    target=../../certs/CA/RSA_Security_1024_v3.pem
-link path=etc/openssl/certs/11f154d6.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority_-_G3.pem
-link path=etc/openssl/certs/124bbd54.0 \
-    target=../../certs/CA/Comodo_Trusted_Services_root.pem
-link path=etc/openssl/certs/128b9c8d.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/12ac4d91.0 \
-    target=../../certs/CA/AOL_Time_Warner_Root_Certification_Authority_2.pem
-link path=etc/openssl/certs/12d55845.0 \
-    target=../../certs/CA/DST_Root_CA_X3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/157753a5.0 \
-    target=../../certs/CA/AddTrust_External_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/166851b2.0 \
-    target=../../certs/CA/Entrust.net_Secure_Personal_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/16b3fe3c.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA_-_RSA_Implementation.pem
-link path=etc/openssl/certs/17b51fe6.0 \
-    target=../../certs/CA/Certplus_Class_2_Primary_CA.pem
-link path=etc/openssl/certs/19899da5.0 \
-    target=../../certs/CA/Entrust.net_Global_Secure_Server_CA.pem
-link path=etc/openssl/certs/1dac3003.0 \
-    target=../../certs/CA/DST_ACES_CA_X6.pem
-link path=etc/openssl/certs/1dcd6f4c.0 target=../../certs/CA/Taiwan_GRCA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/1ec4d31a.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority_-_G2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/201cada0.0 \
-    target=../../certs/CA/America_Online_Root_Certification_Authority_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/20d096ba.0 \
-    target=../../certs/CA/ValiCert_Class_1_VA.pem
-link path=etc/openssl/certs/219d9499.0 \
-    target=../../certs/CA/Go_Daddy_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2251b13a.0 \
-    target=../../certs/CA/ComSign_Secured_CA.pem
-link path=etc/openssl/certs/23f4c490.0 \
-    target=../../certs/CA/Starfield_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/244b5494.0 \
-    target=../../certs/CA/DigiCert_High_Assurance_EV_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/24ad0b63.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority.pem
-link path=etc/openssl/certs/256fd83b.0 \
-    target=../../certs/CA/TC_TrustCenter,_Germany,_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2835ab7b.0 \
-    target=../../certs/CA/GTE_CyberTrust_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2ab3b959.0 \
-    target=../../certs/CA/NetLock_Express_Class_C_Root.pem
-link path=etc/openssl/certs/2afc57aa.0 \
-    target=../../certs/CA/TC_TrustCenter_Class_2_CA_II.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2c3e3f84.0 \
-    target=../../certs/CA/UTN_USERFirst_Object_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2c543cd1.0 \
-    target=../../certs/CA/GeoTrust_Global_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2cfc4974.0 \
-    target=../../certs/CA/TDC_OCES_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2e4eed3c.0 \
-    target=../../certs/CA/thawte_Primary_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/2e5ac55d.0 \
-    target=../../certs/CA/DST_Root_CA_X3.pem
-link path=etc/openssl/certs/2edf7016.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority.pem
-link path=etc/openssl/certs/2fa87019.0 \
-    target=../../certs/CA/Network_Solutions_Certificate_Authority.pem
-link path=etc/openssl/certs/2fb1850a.0 \
-    target=../../certs/CA/America_Online_Root_Certification_Authority_2.pem
-link path=etc/openssl/certs/31044350.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA.pem
-link path=etc/openssl/certs/33815e15.0 \
-    target=../../certs/CA/StartCom_Certification_Authority.pem
-link path=etc/openssl/certs/343eb6cb.0 \
-    target=../../certs/CA/Cybertrust_Global_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/3513523f.0 \
-    target=../../certs/CA/DigiCert_Global_Root_CA.pem
-link path=etc/openssl/certs/399e7759.0 \
-    target=../../certs/CA/DigiCert_Global_Root_CA.pem
-link path=etc/openssl/certs/3a3b02ce.0 \
-    target=../../certs/CA/OISTE_WISeKey_Global_Root_GA_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/3a7f6b22.0 \
-    target=../../certs/CA/Thawte_Personal_Basic_CA.pem
-link path=etc/openssl/certs/3ad48a91.0 \
-    target=../../certs/CA/Baltimore_CyberTrust_Root.pem
-link path=etc/openssl/certs/3c58f906.0 \
-    target=../../certs/CA/AddTrust_External_Root.pem
-link path=etc/openssl/certs/3c860d51.0 \
-    target=../../certs/CA/SwissSign_Gold_CA_-_G2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/3dfd7537.0 \
-    target=../../certs/CA/Visa_International_Global_Root_2.pem
-link path=etc/openssl/certs/3e7271e8.0 \
-    target=../../certs/CA/Entrust.net_Premium_2048_Secure_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/3ee7e181.0 \
-    target=../../certs/CA/IGC_A.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/40547a79.0 \
-    target=../../certs/CA/COMODO_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/40e67a49.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_4.pem
-link path=etc/openssl/certs/412bea73.0 \
-    target=../../certs/CA/Thawte_Personal_Premium_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/415660c1.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority.pem
-link path=etc/openssl/certs/4166ec0c.0 \
-    target=../../certs/CA/RSA_Security_1024_v3.pem
-link path=etc/openssl/certs/4184de39.0 \
-    target=../../certs/CA/IPS_Timestamping_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4304c5e5.0 \
-    target=../../certs/CA/Network_Solutions_Certificate_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/442adcac.0 \
-    target=../../certs/CA/Certum_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4597689c.0 \
-    target=../../certs/CA/Equifax_Secure_eBusiness_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4615970e.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_2.pem
-link path=etc/openssl/certs/4643210f.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_4.pem
-link path=etc/openssl/certs/46b2fd3b.0 \
-    target=../../certs/CA/SwissSign_Platinum_CA_-_G2.pem
-link path=etc/openssl/certs/47996b5c.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA_-_Entrust_Implementation.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/480720ec.0 \
-    target=../../certs/CA/GeoTrust_Primary_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/48ef30f1.0 \
-    target=../../certs/CA/TC_TrustCenter,_Germany,_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4a6481c9.0 \
-    target=../../certs/CA/GlobalSign_Root_CA_-_R2.pem
-link path=etc/openssl/certs/4d654d1d.0 \
-    target=../../certs/CA/GTE_CyberTrust_Global_Root.pem
-link path=etc/openssl/certs/4e18c148.0 \
-    target=../../certs/CA/Deutsche_Telekom_Root_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4efc7a23.0 \
-    target=../../certs/CA/Entrust.net_Global_Secure_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/4f316efb.0 \
-    target=../../certs/CA/SwissSign_Gold_CA_-_G2.pem
-link path=etc/openssl/certs/4fbd6bfa.0 \
-    target=../../certs/CA/UTN_DATACorp_SGC_Root_CA.pem
-link path=etc/openssl/certs/5021a0a2.0 \
-    target=../../certs/CA/TC_TrustCenter_Universal_CA_I.pem
-link path=etc/openssl/certs/5046c355.0 \
-    target=../../certs/CA/SwissSign_Silver_CA_-_G2.pem
-link path=etc/openssl/certs/54edfa5d.0 \
-    target=../../certs/CA/TC_TrustCenter,_Germany,_Class_3_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/55a10908.0 \
-    target=../../certs/CA/ValiCert_Class_2_VA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/5620c4aa.0 \
-    target=../../certs/CA/TC_TrustCenter_Class_3_CA_II.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/56657bde.0 \
-    target=../../certs/CA/Comodo_Trusted_Services_root.pem
-link path=etc/openssl/certs/56b8a0b6.0 \
-    target=../../certs/CA/TURKTRUST_Certificate_Services_Provider_Root_2.pem
-link path=etc/openssl/certs/57692373.0 \
-    target=../../certs/CA/GeoTrust_Global_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/578d5c04.0 \
-    target=../../certs/CA/Equifax_Secure_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/57b0f75e.0 \
-    target=../../certs/CA/UTN-USER_First-Network_Applications.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/57bcb2da.0 \
-    target=../../certs/CA/SwissSign_Silver_CA_-_G2.pem
-link path=etc/openssl/certs/58a44af1.0 target=../../certs/CA/IGC_A.pem
-link path=etc/openssl/certs/594f1775.0 \
-    target=../../certs/CA/Equifax_Secure_CA.pem
-link path=etc/openssl/certs/5a3f0ff8.0 \
-    target=../../certs/CA/COMODO_Certification_Authority.pem
-link path=etc/openssl/certs/5a5372fc.0 \
-    target=../../certs/CA/NetLock_Business_Class_B_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/5a950642.0 \
-    target=../../certs/CA/IPS_CLASEA1_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/5ad8a5d6.0 \
-    target=../../certs/CA/GlobalSign_Root_CA.pem
-link path=etc/openssl/certs/5cf9d536.0 \
-    target=../../certs/CA/QuoVadis_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/5f267794.0 \
-    target=../../certs/CA/Entrust.net_Secure_Server_CA.pem
-link path=etc/openssl/certs/635ccfd5.0 \
-    target=../../certs/CA/NetLock_Express_Class_C_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6410666e.0 \
-    target=../../certs/CA/Taiwan_GRCA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/64d1f6f4.0 \
-    target=../../certs/CA/Thawte_Personal_Freemail_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/653b494a.0 \
-    target=../../certs/CA/Baltimore_CyberTrust_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/667c66d4.0 \
-    target=../../certs/CA/Swisscom_Root_CA_1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/67d559d1.0 \
-    target=../../certs/CA/Sonera_Class_1_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/686ef281.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA_-_Entrust_Implementation.pem
-link path=etc/openssl/certs/69105f4f.0 \
-    target=../../certs/CA/DigiCert_Assured_ID_Root_CA.pem
-link path=etc/openssl/certs/6adf0799.0 \
-    target=../../certs/CA/Wells_Fargo_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6b99d060.0 \
-    target=../../certs/CA/Entrust_Root_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6cb3815b.0 \
-    target=../../certs/CA/Verisign_Time_Stamping_Authority_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6cc3c4c3.0 \
-    target=../../certs/CA/Thawte_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6db5a580.0 \
-    target=../../certs/CA/IPS_CLASEA3_root.pem
-link path=etc/openssl/certs/6e8bf996.0 \
-    target=../../certs/CA/Certum_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/6faac4e3.0 \
-    target=../../certs/CA/Verisign_Class_4_Public_Primary_Certification_Authority_-_G2.pem
-link path=etc/openssl/certs/6fcc125d.0 \
-    target=../../certs/CA/Visa_eCommerce_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/706f604c.0 \
-    target=../../certs/CA/XRamp_Global_CA_Root.pem
-link path=etc/openssl/certs/709afd2b.0 \
-    target=../../certs/CA/Thawte_Personal_Freemail_CA.pem
-link path=etc/openssl/certs/72bf6a04.0 \
-    target=../../certs/CA/IPS_CLASEA3_root.pem
-link path=etc/openssl/certs/72fa7371.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority_-_G2.pem
-link path=etc/openssl/certs/74c26bd0.0 \
-    target=../../certs/CA/Equifax_Secure_Global_eBusiness_CA.pem
-link path=etc/openssl/certs/755f7420.0 \
-    target=../../certs/CA/Sonera_Class_1_Root_CA.pem
-link path=etc/openssl/certs/75680d2e.0 \
-    target=../../certs/CA/Comodo_AAA_Services_root.pem
-link path=etc/openssl/certs/7651b327.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority.pem
-link path=etc/openssl/certs/76579174.0 \
-    target=../../certs/CA/XRamp_Global_CA_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/76cb8f92.0 \
-    target=../../certs/CA/Cybertrust_Global_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/76faf6c0.0 \
-    target=../../certs/CA/QuoVadis_Root_CA_3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/778e3cb0.0 \
-    target=../../certs/CA/UTN_DATACorp_SGC_Root_CA.pem
-link path=etc/openssl/certs/788c9bfc.0 \
-    target=../../certs/CA/Visa_International_Global_Root_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/790a7190.0 \
-    target=../../certs/CA/DST_ACES_CA_X6.pem
-link path=etc/openssl/certs/7999be0d.0 \
-    target=../../certs/CA/GeoTrust_Global_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/79ad8b43.0 \
-    target=../../certs/CA/Equifax_Secure_eBusiness_CA_1.pem
-link path=etc/openssl/certs/7a481e66.0 \
-    target=../../certs/CA/TC_TrustCenter_Class_3_CA_II.pem
-link path=etc/openssl/certs/7a819ef2.0 \
-    target=../../certs/CA/QuoVadis_Root_CA_2.pem
-link path=etc/openssl/certs/7d3cd826.0 \
-    target=../../certs/CA/RSA_Root_Certificate_1.pem
-link path=etc/openssl/certs/7d453d8f.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/7d5a75e4.0 \
-    target=../../certs/CA/WellsSecure_Public_Root_Certificate_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/812e17de.0 \
-    target=../../certs/CA/Deutsche_Telekom_Root_CA_2.pem
-link path=etc/openssl/certs/81b9768f.0 \
-    target=../../certs/CA/DigiCert_High_Assurance_EV_Root_CA.pem
-link path=etc/openssl/certs/8317b10c.0 \
-    target=../../certs/CA/NetLock_Qualified_Class_QA_Root.pem
-link path=etc/openssl/certs/8470719d.0 \
-    target=../../certs/CA/RSA_Security_2048_v3.pem
-link path=etc/openssl/certs/84cba82f.0 \
-    target=../../certs/CA/TURKTRUST_Certificate_Services_Provider_Root_1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/861a399d.0 \
-    target=../../certs/CA/AddTrust_Low-Value_Services_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/861e0100.0 \
-    target=../../certs/CA/NetLock_Qualified_Class_QA_Root.pem
-link path=etc/openssl/certs/86f32474.0 \
-    target=../../certs/CA/IPS_CLASE3_root.pem
-link path=etc/openssl/certs/87753b0d.0 \
-    target=../../certs/CA/GeoTrust_Universal_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/8867006a.0 \
-    target=../../certs/CA/GeoTrust_Universal_CA_2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/88f89ea7.0 \
-    target=../../certs/CA/TURKTRUST_Certificate_Services_Provider_Root_1.pem
-link path=etc/openssl/certs/89c02a45.0 \
-    target=../../certs/CA/COMODO_ECC_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/8b59b1ad.0 \
-    target=../../certs/CA/AddTrust_Public_Services_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/8f111d69.0 \
-    target=../../certs/CA/MD5_Collisions_Forged_Rogue_CA_25c3.pem
-link path=etc/openssl/certs/8f7b96c4.0 \
-    target=../../certs/CA/Equifax_Secure_eBusiness_CA_2.pem
-link path=etc/openssl/certs/8fe643df.0 \
-    target=../../certs/CA/IPS_CLASEA1_root.pem
-link path=etc/openssl/certs/9339512a.0 \
-    target=../../certs/CA/QuoVadis_Root_CA_3.pem
-link path=etc/openssl/certs/95750816.0 \
-    target=../../certs/CA/Verisign_Time_Stamping_Authority_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/972672fc.0 \
-    target=../../certs/CA/TC_TrustCenter,_Germany,_Class_3_CA.pem
-link path=etc/openssl/certs/9772ca32.0 \
-    target=../../certs/CA/GeoTrust_Primary_Certification_Authority.pem
-link path=etc/openssl/certs/97b4211c.0 \
-    target=../../certs/CA/GTE_CyberTrust_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/98ec67f0.0 \
-    target=../../certs/CA/Thawte_Premium_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9af9f759.0 \
-    target=../../certs/CA/RSA_Root_Certificate_1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9b353c9a.0 \
-    target=../../certs/CA/TDC_Internet_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9c2e7d30.0 \
-    target=../../certs/CA/Sonera_Class_2_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9d520b32.0 \
-    target=../../certs/CA/Security_Communication_EV_RootCA1.pem
-link path=etc/openssl/certs/9d6523ce.0 \
-    target=../../certs/CA/ePKI_Root_Certification_Authority.pem
-link path=etc/openssl/certs/9dbefe7b.0 \
-    target=../../certs/CA/Security_Communication_EV_RootCA1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9e6afd31.0 \
-    target=../../certs/CA/Thawte_Time_Stamping_CA.pem
-link path=etc/openssl/certs/9ec3a561.0 \
-    target=../../certs/CA/UTN_USERFirst_Email_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/9f541fb4.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a01d1cc2.0 \
-    target=../../certs/CA/IPS_Servidores_root.pem
-link path=etc/openssl/certs/a0bc6fbb.0 \
-    target=../../certs/CA/Camerfirma_Global_Chambersign_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a137bd1c.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA-Baltimore_Implementation.pem
-link path=etc/openssl/certs/a15b3b6b.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_3.pem
-link path=etc/openssl/certs/a2df7ad7.0 \
-    target=../../certs/CA/AddTrust_Public_Services_Root.pem
-link path=etc/openssl/certs/a3896b44.0 \
-    target=../../certs/CA/Security_Communication_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a5fd78f0.0 \
-    target=../../certs/CA/TC_TrustCenter_Class_2_CA_II.pem
-link path=etc/openssl/certs/a6776c69.0 \
-    target=../../certs/CA/IPS_Chained_CAs_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a6a593ba.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_1.pem
-link path=etc/openssl/certs/a7605362.0 \
-    target=../../certs/CA/Sonera_Class_2_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a760e1bd.0 \
-    target=../../certs/CA/Visa_eCommerce_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/a8dee976.0 \
-    target=../../certs/CA/SwissSign_Platinum_CA_-_G2.pem
-link path=etc/openssl/certs/aaa45464.0 \
-    target=../../certs/CA/Thawte_Time_Stamping_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ad088e1d.0 \
-    target=../../certs/CA/GeoTrust_Universal_CA.pem
-link path=etc/openssl/certs/add67345.0 \
-    target=../../certs/CA/NetLock_Notary_Class_A_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ae8153b9.0 \
-    target=../../certs/CA/StartCom_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/aee5f10d.0 \
-    target=../../certs/CA/Entrust.net_Premium_2048_Secure_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/af4f0c93.0 \
-    target=../../certs/CA/Entrust.net_Global_Secure_Personal_CA.pem
-link path=etc/openssl/certs/b0f3e76e.0 \
-    target=../../certs/CA/GlobalSign_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b1159c4c.0 \
-    target=../../certs/CA/DigiCert_Assured_ID_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b13cc6df.0 \
-    target=../../certs/CA/UTN_USERFirst_Hardware_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b1b8a7f3.0 \
-    target=../../certs/CA/OISTE_WISeKey_Global_Root_GA_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b204d74a.0 \
-    target=../../certs/CA/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b42ff584.0 \
-    target=../../certs/CA/Staat_der_Nederlanden_Root_CA.pem
-link path=etc/openssl/certs/b5f329fa.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b66938e9.0 \
-    target=../../certs/CA/Secure_Global_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b7e7231a.0 \
-    target=../../certs/CA/NetLock_Business_Class_B_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/b8e83700.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority_-_G2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/bad35b78.0 \
-    target=../../certs/CA/Verisign_Class_4_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/bb2d49a0.0 \
-    target=../../certs/CA/ComSign_CA.pem
-link path=etc/openssl/certs/bcdd5959.0 \
-    target=../../certs/CA/ValiCert_Class_2_VA.pem
-link path=etc/openssl/certs/bda4cc84.0 \
-    target=../../certs/CA/America_Online_Root_Certification_Authority_1.pem
-link path=etc/openssl/certs/bdacca6f.0 \
-    target=../../certs/CA/Secure_Global_CA.pem
-link path=etc/openssl/certs/bf64f35b.0 \
-    target=../../certs/CA/Entrust_Root_Certification_Authority.pem
-link path=etc/openssl/certs/bf87590f.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA_-_RSA_Implementation.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c0ff1f52.0 \
-    target=../../certs/CA/Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.pem
-link path=etc/openssl/certs/c19d42c7.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority_-_G2.pem
-link path=etc/openssl/certs/c215bc69.0 \
-    target=../../certs/CA/Digital_Signature_Trust_Co._Global_CA_1.pem
-link path=etc/openssl/certs/c33a80d4.0 \
-    target=../../certs/CA/Thawte_Premium_Server_CA.pem
-link path=etc/openssl/certs/c527e4ab.0 \
-    target=../../certs/CA/Verisign_Class_4_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c5e082db.0 \
-    target=../../certs/CA/UTN_USERFirst_Email_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c692a373.0 \
-    target=../../certs/CA/GTE_CyberTrust_Global_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c8841d13.0 \
-    target=../../certs/CA/TC_TrustCenter_Universal_CA_I.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c99398f3.0 \
-    target=../../certs/CA/RSA_Security_2048_v3.pem
-link path=etc/openssl/certs/c9bc75ba.0 \
-    target=../../certs/CA/ABAecom_sub.,_Am._Bankers_Assn._Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/c9f83a1c.0 \
-    target=../../certs/CA/Comodo_Secure_Services_root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ca6e4ad9.0 \
-    target=../../certs/CA/ePKI_Root_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/cb357862.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority_-_G2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/cb59f961.0 \
-    target=../../certs/CA/Camerfirma_Global_Chambersign_Root.pem
-link path=etc/openssl/certs/cb796bc1.0 target=../../certs/CA/StartCom_Ltd..pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/cbeee9e2.0 \
-    target=../../certs/CA/GeoTrust_Global_CA_2.pem
-link path=etc/openssl/certs/ccb919f9.0 \
-    target=../../certs/CA/UTN_USERFirst_Object_Root_CA.pem
-link path=etc/openssl/certs/cdaebb72.0 \
-    target=../../certs/CA/Staat_der_Nederlanden_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ce026bf8.0 \
-    target=../../certs/CA/Firmaprofesional_Root_CA.pem
-link path=etc/openssl/certs/cf701eeb.0 \
-    target=../../certs/CA/SecureTrust_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/d0cba2e5.0 \
-    target=../../certs/CA/StartCom_Ltd..pem
-link path=etc/openssl/certs/d2adc77d.0 \
-    target=../../certs/CA/Entrust.net_Global_Secure_Personal_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/d495d385.0 \
-    target=../../certs/CA/IPS_Timestamping_root.pem
-link path=etc/openssl/certs/d537fba6.0 \
-    target=../../certs/CA/TDC_Internet_Root_CA.pem
-link path=etc/openssl/certs/d78a75c7.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/d7e8dc79.0 \
-    target=../../certs/CA/QuoVadis_Root_CA_2.pem
-link path=etc/openssl/certs/d8274e24.0 \
-    target=../../certs/CA/UTN-USER_First-Network_Applications.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/d9d12c58.0 \
-    target=../../certs/CA/NetLock_Notary_Class_A_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/dc45b0bd.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/dc4ebcb9.0 \
-    target=../../certs/CA/IPS_CLASE1_root.pem
-link path=etc/openssl/certs/ddc328ff.0 \
-    target=../../certs/CA/Thawte_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/e113c810.0 \
-    target=../../certs/CA/Certigna.pem
-link path=etc/openssl/certs/e268a4c5.0 \
-    target=../../certs/CA/AddTrust_Low-Value_Services_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/e536d871.0 \
-    target=../../certs/CA/AddTrust_Qualified_Certificates_Root.pem
-link path=etc/openssl/certs/e60bf0c0.0 \
-    target=../../certs/CA/Swisscom_Root_CA_1.pem
-link path=etc/openssl/certs/e7461595.0 \
-    target=../../certs/CA/MD5_Collisions_Forged_Rogue_CA_25c3.pem
-link path=etc/openssl/certs/e775ed2d.0 \
-    target=../../certs/CA/GeoTrust_Universal_CA.pem
-link path=etc/openssl/certs/e7b8d656.0 \
-    target=../../certs/CA/Equifax_Secure_eBusiness_CA_1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/eacdeb40.0 \
-    target=../../certs/CA/America_Online_Root_Certification_Authority_1.pem
-link path=etc/openssl/certs/ed049835.0 \
-    target=../../certs/CA/Verisign_Class_4_Public_Primary_Certification_Authority_-_G2.pem
-link path=etc/openssl/certs/ed524cf5.0 \
-    target=../../certs/CA/Entrust.net_Secure_Server_CA.pem
-link path=etc/openssl/certs/ed62f4e3.0 \
-    target=../../certs/CA/Verisign_Class_2_Public_Primary_Certification_Authority_-_G2.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ed9bb25c.0 \
-    target=../../certs/CA/AOL_Time_Warner_Root_Certification_Authority_1.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ee1365c0.0 \
-    target=../../certs/CA/Verisign_Class_1_Public_Primary_Certification_Authority_-_G3.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ee64a828.0 \
-    target=../../certs/CA/Comodo_AAA_Services_root.pem
-link path=etc/openssl/certs/ee7cd6fb.0 \
-    target=../../certs/CA/Camerfirma_Chambers_of_Commerce_Root.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/eed8c118.0 \
-    target=../../certs/CA/COMODO_ECC_Certification_Authority.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/ef2f636c.0 \
-    target=../../certs/CA/Equifax_Secure_Global_eBusiness_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f060240e.0 \
-    target=../../certs/CA/Certplus_Class_2_Primary_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f081611a.0 \
-    target=../../certs/CA/Go_Daddy_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f2cce23a.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f3377b1b.0 \
-    target=../../certs/CA/Security_Communication_Root_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f387163d.0 \
-    target=../../certs/CA/Starfield_Class_2_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f39fc864.0 \
-    target=../../certs/CA/SecureTrust_CA.pem
-link path=etc/openssl/certs/f3cf1e8e.0 \
-    target=../../certs/CA/beTRUSTed_Root_CA-Baltimore_Implementation.pem
-link path=etc/openssl/certs/f4996e82.0 \
-    target=../../certs/CA/ValiCert_Class_1_VA.pem
-link path=etc/openssl/certs/f559733c.0 \
-    target=../../certs/CA/S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN.pem
-link path=etc/openssl/certs/f58a60fe.0 \
-    target=../../certs/CA/ComSign_Secured_CA.pem
-link path=etc/openssl/certs/f61bff45.0 \
-    target=../../certs/CA/Microsec_e-Szigno_Root_CA.pem
-link path=etc/openssl/certs/f64d9715.0 \
-    target=../../certs/CA/IPS_Servidores_root.pem
-link path=etc/openssl/certs/f73e89fd.0 \
-    target=../../certs/CA/Verisign_RSA_Secure_Server_CA.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/f90208f7.0 \
-    target=../../certs/CA/Camerfirma_Chambers_of_Commerce_Root.pem
-link path=etc/openssl/certs/f950ccc2.0 \
-    target=../../certs/CA/IPS_CLASE1_root.pem
-link path=etc/openssl/certs/facacbc6.0 \
-    target=../../certs/CA/VeriSign_Class_3_Public_Primary_Certification_Authority_-_G5.pem
-link path=etc/openssl/certs/fde84897.0 target=../../certs/CA/Certigna.pem
-$(OPENSSL10_ONLY)link path=etc/openssl/certs/fe30b214.0 \
-    target=../../certs/CA/ABAecom_sub.,_Am._Bankers_Assn._Root_CA.pem
-link path=etc/openssl/certs/ff588423.0 target=../../certs/CA/ComSign_CA.pem
-link path=etc/openssl/certs/ff783690.0 \
-    target=../../certs/CA/UTN_USERFirst_Hardware_Root_CA.pem
