# ------------------------------------------------------------------
#
#    Copyright (C) 2002-2005 Novell/SUSE
#    Copyright (C) 2010-2011 Canonical Ltd.
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  abi <abi/3.0>,

  /etc/ca-certificates/{,**} r,
  /etc/{,libre}ssl/ r,
  /etc/{,libre}ssl/cert.pem r,
  /etc/{,libre}ssl/certs/{,**} r,
  /{etc,usr/share}/pki/bl[ao]cklist/{,*} r,
  /{etc,usr/share}/pki/trust/{,*} r,
  /{etc,usr/share}/pki/trust/{bl[oa]cklist,anchors}/{,**} r,
  /usr/share/ca-certificates/{,**} r,
  /usr/share/ssl/certs/ca-bundle.crt          r,
  /usr/local/share/ca-certificates/{,**} r,
  /var/lib/ca-certificates/{,**} r,

  # acmetool
  /var/lib/acme/certs/*/chain r,
  /var/lib/acme/certs/*/cert r,

  # dehydrated
  /{etc,var/lib}/dehydrated/certs/*/cert*.pem r,
  /{etc,var/lib}/dehydrated/certs/*/chain*.pem r,
  /{etc,var/lib}/dehydrated/certs/*/fullchain*.pem r,
  /{etc,var/lib}/dehydrated/certs/*/ocsp*.der r,

  # certbot
  /etc/letsencrypt/archive/*/cert*.pem r,
  /etc/letsencrypt/archive/*/chain*.pem r,
  /etc/letsencrypt/archive/*/fullchain*.pem r,

  /etc/certbot/archive/*/cert*.pem r,
  /etc/certbot/archive/*/chain*.pem r,
  /etc/certbot/archive/*/fullchain*.pem r,

  # crypto policies used by various libraries
  /etc/crypto-policies/*/*.txt r,
  /usr/share/crypto-policies/*/*.txt r,

  # Include additions to the abstraction
  include if exists <abstractions/ssl_certs.d>