Bug#1142349: ca-certificates: certdata2pem.py drops S/MIME-trusted-but-TLS-distrusted CAs, breaking S/MIME verification for chains Mozilla still trusts

[Bastian Blank]

On Sat, Jul 18, 2026 at 11:10:01AM +0100, David Woodhouse wrote:
> 3. Emit a separate email trust bundle -- e.g.
>    /etc/ssl/certs/email-trust.crt -- for consumers that want S/MIME-only
>    anchors distinct from TLS.

You mean /etc/ssl/certs-smime and /etc/ssl/certs-trust(?). The
directories itself define the trust anchors, not the concatenated bundle
files.

Bastian

-- 
There is a multi-legged creature crawling on your shoulder.
                -- Spock, "A Taste of Armageddon", stardate 3193.9