From 80176bb4eb19bf97bbb236b0ce297683a01c54b0 Mon Sep 17 00:00:00 2001
From: Simon Clark <simon.richard.clark@gmail.com>
Date: Apr 23 2018 16:56:29 +0000
Subject: Add #97 'OpenLDAP defaults to use only Shared System Certificates'


---

diff --git a/en-US/sysadmin/Security.adoc b/en-US/sysadmin/Security.adoc
index 80dc35a..9ae92ff 100644
--- a/en-US/sysadmin/Security.adoc
+++ b/en-US/sysadmin/Security.adoc
@@ -33,3 +33,8 @@ certutil -d sql:</path/to/database> -N -f </path/to/database/password/file> \
 == OpenLDAP switches from NSS to OpenSSL
 
 With this update, the OpenLDAP distribution in Fedora changed from using the *NSS* (or *MozNSS*) library to the *OpenSSL* library for providing cryptographic functions. The switch promises better support from OpenLDAP upstream, which had ceased maintaining the NSS support layer.
+
+
+== OpenLDAP defaults to use only Shared System Certificates
+
+OpenLDAP clients and server now use the https://fedoraproject.org/wiki/Features/SharedSystemCertificates[system-wide certificate store] by default, instead of `/etc/openldap/certs`.