From 156b0e4aaf02b6ad5edf734945253e48d90f2c58 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 16:03:38 +0100
Subject: [PATCH] fw-addr-lists: www.dshield.org requires 'GTS Root R4'

---
 certs/Makefile    | 2 +-
 global-config.rsc | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index 35a50c81..da681d09 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -27,7 +27,7 @@ DOMAINS_IPV4 = \
 	ipv4.tunnelbroker.net/Starfield-Root-Certificate-Authority-G2 \
 	mkcert.org/ISRG-Root-X1 \
 	ntfy.sh/ISRG-Root-X1 \
-	www.dshield.org/ISRG-Root-X1 \
+	www.dshield.org/GTS-Root-R4 \
 	www.spamhaus.org/GTS-Root-R4
 DOMAINS_IPV6 = \
 	[2606\:4700\:4700\:\:1111]/DigiCert-Global-Root-G2 \
diff --git a/global-config.rsc b/global-config.rsc
index 19787a8d..9c35d13f 100644
--- a/global-config.rsc
+++ b/global-config.rsc
@@ -117,7 +117,7 @@
 #     # higher level (decrease the numerical value) for more addresses, and vice versa
       cert="USERTrust RSA Certification Authority" };
     { url="https://www.dshield.org/block.txt"; cidr="/24";
-      cert="ISRG Root X1" };
+      cert="GTS Root R4" };
     { url="https://lists.blocklist.de/lists/strongips.txt";
       cert="GTS Root R4" };
 #    { url="https://www.spamhaus.org/drop/drop_v4.json";