tech stuff.

Did your commands with custom -CApath stop working after upgrading to Oneiric? Mine did. It turns out Oneiric introduced a change (via OpenSSL 1.0.0, maybe?) that changed the subject hash algorithm used to index certificates in a -CApath directory. Look for a handy code snippet after the jump.

for cert in *.crt; do
hash=$(openssl x509 -in $cert -noout -hash)
test -f $hash.0 || ln -s $cert $hash.0
done