From aebe7bd054aea238b8b2e73eb01fb44f10f9404a Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 14:51:22 +0100
Subject: [PATCH 1/7] certs: add Let's Encrypt 'Root YE' for future use

https://letsencrypt.org/2025/11/24/gen-y-hierarchy
https://letsencrypt.org/certificates/#root-cas
---
 certs/Root-YE.pem | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 certs/Root-YE.pem

diff --git a/certs/Root-YE.pem b/certs/Root-YE.pem
new file mode 100644
index 00000000..855cece5
--- /dev/null
+++ b/certs/Root-YE.pem
@@ -0,0 +1,19 @@
+# Issuer: C=US, O=ISRG, CN=Root YE
+# Subject: C=US, O=ISRG, CN=Root YE
+# Label: "Root YE"
+# Serial: A4026BA2EF6C7C20D4047E5E65A69380
+# MD5 Fingerprint: 93:61:B1:AC:E4:DC:A4:8B:C6:FF:A4:A2:2B:D4:64:64
+# SHA1 Fingerprint: A9:57:15:57:A7:7D:B7:8F:FA:C2:E9:7B:57:B8:98:56:90:39:C3:40
+# SHA256 Fingerprint: E1:4F:FC:AD:5B:00:25:73:10:06:CA:A4:3A:12:1A:22:D8:E9:70:0F:4F:B9:CF:85:2F:02:A7:08:AA:5D:56:66
+-----BEGIN CERTIFICATE-----
+MIIB2TCCAWCgAwIBAgIRAKQCa6LvbHwg1AR+XmWmk4AwCgYIKoZIzj0EAwMwLjEL
+MAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWUUwHhcN
+MjUwOTAzMDAwMDAwWhcNNDUwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzENMAsG
+A1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZRTB2MBAGByqGSM49AgEGBSuBBAAi
+A2IABDwS/6vhrcVqcbBo+wgdI3fwn9x7DNJJOY/lTOti0vkwuRN87RhEhTH17E7X
+yFjWsPYhIPt/wzOqxTd2b+4ZJNy9ID04YywF9U5zasDVyGSNErVNtz8uSGh5izW8
+7j77GaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O
+BBYEFKPIJlqOoUzQNWP8myPIOq5W809WMAoGCCqGSM49BAMDA2cAMGQCMHhMr8N9
+LdL1VQKs9BdV81r76eXRB6mtjuNjzk6/lBsPNToWLTDzGYgtQKO1jl63uAIwGV7m
+onyF377c+MM1oqVNs17sgu7F9YKZwgLmVbeOMDbKAXHtKMDLbiGllCcs8f47
+-----END CERTIFICATE-----

From 244eceafee495d68648412d2c3c583668c802242 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 16 Jan 2026 12:51:43 +0100
Subject: [PATCH 2/7] certs: add Let's Encrypt 'Root YR' for future use

https://letsencrypt.org/2025/11/24/gen-y-hierarchy
https://letsencrypt.org/certificates/#root-cas
---
 certs/Root-YR.pem | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 certs/Root-YR.pem

diff --git a/certs/Root-YR.pem b/certs/Root-YR.pem
new file mode 100644
index 00000000..b4625f4e
--- /dev/null
+++ b/certs/Root-YR.pem
@@ -0,0 +1,37 @@
+# Issuer: C=US, O=ISRG, CN=Root YR
+# Subject: C=US, O=ISRG, CN=Root YR
+# Label: "Root YR"
+# Serial: EC46349360CF4B0FF8A982D93AA9CA3D
+# MD5 Fingerprint: B7:C3:9E:B2:5C:FA:D6:0D:0B:F8:7F:A6:D8:A0:95:F7
+# SHA1 Fingerprint: C5:F1:11:DA:84:F7:DE:F8:E6:F3:F9:9F:8F:5F:36:FF:85:BA:B1:B1
+# SHA256 Fingerprint: E5:7B:7E:6F:15:0C:41:91:02:E8:D5:C0:55:72:9F:F9:67:B9:D1:A8:29:BF:00:CE:C8:9C:A6:04:EB:F4:A8:6F
+-----BEGIN CERTIFICATE-----
+MIIFKTCCAxGgAwIBAgIRAOxGNJNgz0sP+KmC2Tqpyj0wDQYJKoZIhvcNAQELBQAw
+LjELMAkGA1UEBhMCVVMxDTALBgNVBAoTBElTUkcxEDAOBgNVBAMTB1Jvb3QgWVIw
+HhcNMjUwOTAzMDAwMDAwWhcNNDUwOTAyMjM1OTU5WjAuMQswCQYDVQQGEwJVUzEN
+MAsGA1UEChMESVNSRzEQMA4GA1UEAxMHUm9vdCBZUjCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBANvGJnN78CTJdWL3+eGfsLN5TrNBJs+VH9hRXqRbwxu9
+sGNiB0BD1fcOxbSUQCJIM1xE13Db+5Cw1w0s0EBYsvuIP/6joF0w8cuImbgR1OGg
+YbSQ4OpzI+DG8SGuTlcE873OCS+kh3srlo6vl43M5OJg4Aeo1sfHp6kTJDoIiFBN
+JAY+OKfX/FUvYKuhjT+no49lmqmupSBI5PkBQiqrEGtWU5uxU/cQWHGu8jSjFBzn
+ZqvbNPLMXMLFxCb3WTfrJBXXjqvWG+v4bjzxjjeAtOlU7qarRDvNOyAuQYLln904
+M+faKx8hnLCpJ15ZqaEgcNlY+9MMWcC5yvL2A2j3l9+2buggZX+dOE91zYmIdawT
+vSZuVvlbRrAlLxIB6pwMBjneXCjYQ8+3BCCjssbSNpZU3hTcBDdhfAlEDlYr6pEa
+tnMdmDT5BqnKC92bd0EhM1fbLHioLccLCuievT8ZkPhZrq7Mii7gNXAcUEAR8+lz
+Yal+9zTg7C5DALyVOeG/CqfRAMn1KSHCR0NSA6P8tn/mGRlnCct5rtVCLnVySVpU
+6H1qGg3DgTOuskf8eahTMiYbI5ezPJmO5ertalskQ1utp74+eDy92PI4ftHKTbq9
+IWhH4YZKh3WnJEIt+oQvlYZbY8tpEroKrFB6PFGzrJIDRyts4HqvuH52RFj2zv/B
+AgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
+DgQWBBTe51tg0CJtQCh9Pw0B/qS1UrRRlDANBgkqhkiG9w0BAQsFAAOCAgEAWHnf
+713Bdkq7t5yN2dNIgQakUb94X9WuyhMEHHkgx4oDpSUlnG0w4g94MoqaEUE31ZjR
+LU7L5LD1g9ujFHTQu8AD215AHMVQFbm6j8hQxdXHAzDajFNQnOlDJrLjzIx176oy
+AjvUtejZx2NNmdb5fd0WGVGsCdoAJ3N8ozo7ajE8t6vfxStZb4BQ9WYJGHUDrv2N
+i5tJF6CNiPnlzs3BUfECRbE4JSk+jvy8+VoGiFE8qsH/j78x2fjgQhAQFV7P7Zxy
+dBTZ1wEkNpZNW2qnaK1SKBLa+xf6E06YRIq5uaI+HWH8SY1y5VbRgzq40EKg3yxP
+06fz+uYAUIFJoLNfhwRCc3Q6pQVuMX3yAjHAes4gk4moGcLQ5p7HAh39yeylZc1J
+41sx/jKwLIkPE6Rr1Nf4pxdsxf9SA4yOEiAkDgq04DVxn8hgYFdUtBCuiuVC2heA
+EiqVEa+8QZjuw8Gj0EbHXcRd1nInvGqRS1o9Is7YBdQN57X1AYveGBNNqjICSb7c
+awuw1EawTDrs13VUlJVEsbQ0/O/1aaV73mCdOQ8azqL2KTv1Ewu1xbquE2S+kdQU
+To9TUwat3wUA6cwXh1EfpS/3fJ0aGah5hdpRyoCLDlsSn8tkrjMfFFX0viC+GxHc
+sI1ANRYvqSFC2X1VRZfDg+wD6E21BccmifG4yWc=
+-----END CERTIFICATE-----

From 68a4ac942e6f2521426359c717f101733c916d60 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 15:57:29 +0100
Subject: [PATCH 3/7] certs: update *.eworm.de for new Let's Encrypt 'Root YE'

---
 certs/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/certs/Makefile b/certs/Makefile
index 4114b3ff..2f6155b3 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -12,11 +12,11 @@ DOMAINS_DUAL = \
 	cloudflare-dns.com/SSL-com-Root-Certification-Authority-ECC \
 	dns.google/GTS-Root-R4 \
 	dns.quad9.net/DigiCert-Global-Root-G3 \
-	git.eworm.de/ISRG-Root-X2 \
+	git.eworm.de/Root-YE \
 	lists.blocklist.de/GTS-Root-R4 \
 	matrix.org/GTS-Root-R4 \
 	raw.githubusercontent.com/USERTrust-RSA-Certification-Authority \
-	rsc.eworm.de/ISRG-Root-X2 \
+	rsc.eworm.de/Root-YE \
 	upgrade.mikrotik.com/ISRG-Root-X1
 DOMAINS_IPV4 = \
 	1.1.1.1/SSL-com-Root-Certification-Authority-ECC \

From 9919b9fe7653bbcde0afb3e6b51b0e4ed89e4045 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 15:40:21 +0100
Subject: [PATCH 4/7] global-functions: $ScriptInstallUpdate: get new Let's
 Encrypt CA 'Root YE'

---
 global-functions.rsc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index 5d2a5044..fc60ff63 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1265,7 +1265,7 @@
   :global SymbolForNotification;
   :global ValidateSyntax;
 
-  :if ([ $CertificateAvailable "ISRG Root X2" "fetch" ] = false) do={
+  :if ([ $CertificateAvailable "Root YE" "fetch" ] = false) do={
     $LogPrint warning $0 ("Downloading certificate failed, trying without.");
   }
 

From 6e8e841906411ac0b0d8910354688e2603dcd7c1 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 15:44:54 +0100
Subject: [PATCH 5/7] README: update for new Let's Encrypt CA 'Root YE'

---
 README.d/01-download-certs.avif | Bin 2761 -> 2671 bytes
 README.d/03-check-certs.avif    | Bin 5079 -> 4970 bytes
 README.md                       |  12 ++++++------
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.d/01-download-certs.avif b/README.d/01-download-certs.avif
index f2afeb545aa1e191f3e9382963bcdc172c40603e..e4d8755c85172346e4e3660279c66b6ad43df4aa 100644
GIT binary patch
delta 2337
zcmV++3EuX}74H;~cmZ6Ic}oF?k;O?8WNl<&bP@mx1~?`1cvcBA&k~a$0cU^D{&0_W
z{V!CWUXNHh-u^}J?CgQ%DYk$d;V1gdpvMgw(&sRr6=KY;D3V;?#;6CKT$;8lMP$TG
z<MbPY75A-!Qc$h1X8%T76?H)mcD5KBX8;4TatZqMTo*4b<#-___RZW_O9b9tn>7KS
zNZatTxu$Xq|D6I4EB%b$WS@UlJvZ!h9)JHrI)rSPrmHyimH_gmk^41jWmYLG{332f
z|G7WY^1Nth#)&-3toHUAhq$H9_JXHWwnXq|gF)J#o49pG=Ve=tN&tCxl#S&z`j-No
z$_dBc=<Nu@I+ESb+bZcwMF9GCZ*BCU2Y2p`d?79>O9`|5tG9e4@sxjL@(p|3CcQ^P
zEc!|nr>Zb*EoHqW&DEJ*(9wwtv6r2;t|QHdGctE|7;!{B21pQH5y0EHM=67t*GGU-
z+^I=`i5fv$D3y<E193R$h;VXKcC25uPe+nmXx{1%7Mw|f3#@I0@o7?YYI9X_?OCIL
z+zYTkAp7|vFqf5WjDdd&ifUHhqjTNZs{jeYh*=*sJ`t(ZVa9#J!-9_I`qlv2Gd?RT
z(I;UjQ??|1^*|ck((S~J>^lC%VIRhX2_cO&lWd@{r?kBO;9{&W$As>u*`fjdXhf7B
zkYv6UFvMN^BPLN0&a^^_Eh^E@`(qfV9k}h7DKxQj0suSnd5(XBA2xmsG%vxz>SNVU
zZW;n_elA|0!#4IZ*Z$Q-s&Tp+fB0cC*6q;)C)Ox@##u17`V)W9OZO1+*jz-KLsv7u
zk~|@8&?Q?AyC@bJ$S#H_T*uh#Q#zrp*cY$|F4vgDt>~&1SIAI)e=0@_k_mQUDgVum
z4EIj@_N<myTpNESV)0Asoh@rqvYM*Omfd@e&L&#5QK?7lmEsSCP2Cqnmx{WY((-fD
zy8x$STVoPk*VpL2Y^j+|_#wo<g1$6w&z;ZKq7~tzc{=4Nm~DPj=$CX@rZ*I|TBGXI
zmr1SGhEG}-keTZfrI^2W&39W$q;VdeIh+IWTdyY_jQ@Z2S07d&-gC=uK=z00ZDReI
zC*)6N@355IH0gtsQv`AK3*xo%sI`E=Fk3`~44N=eoh22W!9r~NQL90<gGdS5o10y;
z&d#({f{XOApOBNtPzD|$sYXg3&}Vpo1bRPs_LxGh56kp`OzUJI_6P>MV;OfD=e|>E
zY1UFN`x}3I_6tNHg=oIrInZ({MXs}VSiqLvKU`!%lKxvPVZQ>C1NYfwQ68QV|5`FX
zqX^={l<8nwO4EtmEJrC^ZxuEkfMU@?yc9p7*v<hDQ9-XL+hyx1>d8AMG^gr>W0>;$
zZT5;e!`o`&(~`0UF)ifU|Bbgm4<RzdlMY+dwxNFzosxwakVHC*Xo}U<)UeULdlMk@
z3SWTmmG+jb6bBo@1}2KuSlle|31HCCP;J0E8y2=|C~f?G_k2{swc-?KB}R`0I*HoU
z#Hb4DQj?M${S9S<IO-}+#Jo_0%u+^q8^KCc$0%K}G|Z~X<MouP7<XdrNaxpIF&${E
zq5^-r;ZZTb8LPUX2t0dnDPBCc{>(BCW3;40eI3|Bsk%u`OEFHa`V{!bw!W5Mhk;Zc
zcK-pVb$^0#a@t-}CUj<hAzbvoT+Q3F1n-R}J9MA|2U3TudYh677OQE5?B}~c@vn-l
zM&wMM#H>UZNcgmJ)C#et(E}FJ?7a@D1mk~a7TKe~#nC;CT%eYmp_p|>0HdnerY0?v
z4#~s>Kej9oFzSU6yj&yHjy;_Llmj}WhZ0H?+V0cjG_T~&gg%cRy9X&FBCS_l#=QXF
zuJmcWM-NH4a)AUgRa5wy9s155wXB_j(;maNrL_E=%cvG;+BW4ye)#xy<qehD_+)>0
zY^ELo^7Xl*U|ZdFnB=^aYhL`$*$K&(SxOO{*fvsaA*&@rC4+basmbADD)lXlGM!_C
zU8bDc!U=UjPqhMej!%nbCZ=Cq1-rz)iO)pA1DBFsj*FZ`uF|yy8*zTtBU@0e>Pq#(
z6Ma#px9d)LkG~Ij7qNSfo84Abdv1S-bkx<uLm-C@acQHpG{KJWLc}WG_dmB}Bwu6T
zc1n1eFqC&~#a-3d$V>!VpIv>2g?RIgr)u%Cq4EE=0BM~v*u2rB<|#g1juEW<)1C^s
zx&BI2v&5w|R5-T~kDmHp2_y8S90dlU!u$e9;+Y^&;um7kr_BMOpIhkUIc$HOg5YC*
z?n;G-qrnPkIJs|=V}`Nbk6zbaY1lHaOSzXX`j-SGHaktKVg;5t*(sA~=xf_$;$;?P
znrNB0pi0ISFyxSGO3R28$cWu34B|K60;u{F_#06=j+d|fs#1vG1pI*<?AlJED(jTg
zx;=Ytcjw6^gLg1Esf(glIZA)=?E9;ynM=+!QXst3h$jgGIE+ll1mWWBhAiF2@R;?l
zyzlNSD;nKdM{};U`_g<Ah2C!ffGKz-;j`xBYSd=n?(1YK?4PH%X@1j=<+hj!6l=a$
z-OJ$uYV5o?7R{GjP#4NAmKzjgDi}MbhhT${yCCqA5Dbgdaj3oO$IE|B5+f)My{9pr
zDzFup9rAm&iUc}yCtrI@z%Je<C$O9x_8))zv@WsPC=Z(7@x%NK06LhGtwP``97jJb
zPv?dZ%0kKsZ3@AHkDf)&Kw|NkiK5~4Hd`v=?k*4jOQ#*H=(wZ})Bytt8UE$@Qp4QV
zys<6V^c+DuKB<ZGO8bB8>ssR~T#e&N-!w!xzH)-SeLMHz4!fd3dk}ink~L|E9aMR#
zQn3?ScH|5Yl>{-h_ZmEnZETI1pC9B9FcZJ0Aoq*J4-5ZpM0d`A{Z!*)ZDYW(Y`6ms
ziQ`3MpjE`Q&L%64Apj{mi;wz$wZZP@P4Aq?lD1lKuG2-0AV_&Juuv|9I&Wc+E|u+t
z=-C8BcDJ(OXr(Sn{AKYQ=EiCZcy<w}_}z5pVJWcoZLJ)$>|gX(6C~`xZ{>OEju-mB
zs(N$RuBgh6vz#eBsd|Jbi)@GGW5}GEj-+5;5hVIW8?kEE{O7<`hof?a$4tixS#^8y
Hl?|HG#Q=}6

delta 2428
zcmV-?34`|U6v-8kcmcMNc}oG7k;O?8zHMY-bP@mx1~?`1c~%KBsS}eR0cU^E0nmr7
z@<HwDgZbovzcAk{qFI~y;`db*E`ZqRNjTh5HEI6`gB$P(k%77+muSSuMIY-x$4JNY
z;kAiD8?11X;~wu~iWMXkJ&L|!iQg0<I3Yc6&zc5*b3f{ngl|x5jQi?D?+_B4x)FwP
z22GJEvA)g>r`IVh8&Tq&!^nRx6B%tdfqI3mm`C5@S`}cnuMAeUlo~=a*oyh%lV?gG
zT^__+G4*?EBK^raAGSLIhDu|KRWILJ9f-+svs1*AJpj)rFi+5QWcW1Y;k|l=)H{Ef
z4Ar}I#2!L=K)StX{u)mU2~&mF<qrhY94b2>gLQb4@4K2MW7<%DqLhDKx$IIA{up|@
z2y`4}0fLU?CRy)#=#B0bb_?cH2Rh&nw*e))om-o#6wCY=a|jaW;Q~todCOd2X|i!`
zd9JtFlz~`sCVIOegKB8|UZ&$I+@$<a^~3zz*NC^Q_(Ek(pbe!l3G*q0HS{b5NNUn#
zHfb#I2xhha-8T&+$J&3GlY71Znj;@5j$nh@S_<m>-6M6~#0-VndSm4sBz_OgJ|mui
z5OcV`X8P+Ce}ht{#$NcI0Vv$)p+CBdm?00wmyY#R@p!vMsQM96yEUNY{O^v+QG+p^
znR30gLD6KmA}`_7Zjkp%gL?`Wuv<I7coLbg?Iwb5PF~q4I+uTJCDGF{Xy>dux#)qJ
zoXoR_1+<KILU&Qc_t}rwKUegd;!tYXT&Ao`I`n#29(WpP2uQiwD@)NP*5Zwh^uKDn
zlDn9}HIL=|sQ66N1A<Sf?^BvxQx1|<8w1u46U?r@<syEFI4vVz$B}V$(mis>oB+1U
zVNGe70E<nR1p0sC_+dfY%tzHtnVSLRS%ph{l%_4sj@@-Fb^en`Ot$Dgyyl{SJK3I`
zM@TaSuyJU&pI4O3y{EF>3i)V&iKZ?vtg91Y5>;=L{j-!Xim|t5rdizp(bk-thn}Gz
zR>f2OE3=Ljs%*;T-dsm^^Yt)8=k<ibkPq}gc|>Zed|H1qpyq>zS=bwDY~A=93wiD6
zwCbya^8FwaI@t(4f&s4B#>Ckl*5Mbg4EE>!uL1?!Mqlt(5wEccUf-tzPvR`{p5+>m
zQ^(X)SAxf^tCf93Q?e=})51UNMo07Sf1>w(pxKKQ35G&AcQ(`*OHT?T&5ztF_dG4z
zxCE~C$H{-ZU3fK(|H#CP|9QNlh65YCAdYYqnFcS42Sl0;8gi|2-!~t=BTPkV^F_YR
z^njrdosxwakVHC*Xo}U<)UeULdl>spW08yOJ*ReWIGGz*PVERb^i(#wl=CexQunql
z9U8E@0f}+@HT8&7sd_X<>XADTicL)E92yd(E0up>4W&;gX7d%=bT1Aa{+h=iPa}9K
zN|@yfwg#Dj*Z#)v*ho~<!d2#4bCvk`=|903@<D%dmYpNQ=HCDt(^^VlBbY^@{XdQr
z&N9B%m#BB$bk<LD$!L!c;JAxAegXBmj(}!8i}~nFEx;#ggoR{^*gk4VR}$nX_JoNz
zXJ3DKl7D3=o_IGQH-!#6BVMb1<p&vtXyog@O~&M^-q#>4tzY0HrV1tMK5_STyp=qH
zk4e)vfu#uDH=Wdb2mJVb4(l=AuI~%SNETO7?~N+Z$SZ|Tn51eGZJDIYcZk6Qh~qg&
zJF2e8e=4p?NWqaC=8QNcrnU$Srfpr0(+_`{AFq`CSphI2rLqlCOc-e5Nwa7NI>}Ya
zxX&^I-nSqBitgiJ1(h)e&<Kcup&3!CkqDWVP;|#7mv^v_sF@TQ4?%&Mp#+(B-efiF
zyvIewirT_-=^ba(sGY6<tz`-5%AzmDl3A$=J|0ZbV8ky1`-dpnZ9m3tB_7ZV$r^tI
zGCDJq4hhVdX(`Ygu?fmu<d53SjUQb*K>gGjEJ_zgVLNhj;Y02Ckjun1vsSZPJtjjd
z#WJyfJR1~BQqd>Wv#}Zs6CZ=GzfwFYt9uIQuTd#1e%loq={Z%^wl|gRf>Pg#(x}xF
z*>k)!+7bcl3Ke=(Q41+s>d>2vYx#d#^{?Av*=eJqcuNlJv4ApbODCPJjdE1?PwwdP
z6nU>U849aGW3HVN_B#FO#fdEzd1}WRk+3w&M}rEgt?H(1-SNR?Ergl7sD0%6aC~$c
zKVIe0LPvZVGeI)+@bT>_rZcRGw%*9bcMT8=45Er8?h~2wl{W0BoP(iUjy`|)OmpeS
z6;s<t!qjpsr5(KDHY8VV3G{X7zC8b&G}-nvDKD5&l9K}QYAz3(9n*|)ik$@N92d@i
zh0R}jjemu`B8A)oHN#Y$r(<PRz=MGtv1Es`U~>`EiT4P14+Q%eCRB5S-X6Wi>h3@(
z7>lL`!mwFlr^JMQjIw<vxG{fUrN-NCxwMUvyhK0XC5^Dp9Cz=BK44BDpXq<RdZ*@d
z0Rr!8v<sPJK3`;u#8tbhij7*lIlY`-ypfaU<EFEIwR5x~<==i-WxBsygb&2zSoUdW
z>RizLr)q>NG=7C0=qs3xLMd4ixy=L@*J?hBi<kZO9(RY3K<MeF{~3SfBD*Z2Q}9!#
zq#R%^GI1m_mf(I=;G{~w^@ApacA5{EzCgQ1vYviEY&7NrJ<wf*y>z*I^X&|wTR9l|
zLMVGE?Xn)TTyi^HloS>DhZmZ(Pvbp~)l$^q<NZ49@!DC%PhF~9M@;CmYMsM2sQ^sf
z&N*ob8P$>se9?2fR^)#PEXVu3T1!Dzu&5hfY-^tc-HwZizexWK7$7l{)z6SNESF`c
zOGYKjR)Pv|&UL>0gVSo#HEAWYT)@ht=l6WX?WhHiZz1>cSk8{|7g-IMN}G0AHL0fm
zud-ix2C0eZy&eDY6&Z%IFP^=MoC)$sJsDa;X9@x5I0ou(nstAW%%MFODNj&$FKts#
zA!Wmz?S1smR3^$&)WQ2^W|YtMma=EBF-Srgrw$iLf<gGL_hS$FS!W*hmFltiri@iq
zSPM?V?_QF_Ge#N~85|3d_V4EVtAgfT^pVZ{cuV7~`4=$+FW?rb?uy02c%v6ZBk0po
zB2g60*zE<GCjnH%Xc>Yt#5EPB{Iz}mL%GP)L~*c8x?aL-1KW=!Yqq_cC-y*PXXn&|
ucuvI?j37oEznR;r9y>3nWinXZYz&9a=4h<D(hYIbzIQFMg48;%-K<I5yt9V@

diff --git a/README.d/03-check-certs.avif b/README.d/03-check-certs.avif
index 1f03ad2c01bc115ffec79e9fd3b60259cfcb4e13..6610ac477ac73888b019290462db67c7a76b1fd6 100644
GIT binary patch
delta 4706
zcmV-o5}obWC+a4UcmY?Dd6g1hZDe6|5&#MYI3@CWRtYl7B$FTk6gS0PoEnAH8j%o|
z+dk*g6Eb<;ihCvRA34YJTc>ei1xjs@9Y7<vMi(B-7#ZMLvw$yKBv*hOnv-q;Ab%Ys
zoze8Mpz7Jm<#ypcTc9hAvMyM(8QVGuldW`ym1EUx3bPiE-0ruJ8PnnMToNTDa4c%+
zt=it6Dq$QL1)E4yb8?3Sdg^m?p+EWCRL`(-95V5ZNFyc0BosV>iWU|x77w!_Xed-s
ze<PiGxU3h#TB4(ZZ_8A7w0ImA$$z~0y{5`9TSaXrYsNF7Myhpnz(E&``^(Np{FGJm
z3(@bWzVU-P@b8p^Xyn12xUT|*(l(nCL>g~^7SL{|Ak&*Asgam`tMfTsb&ZW!q)RnD
z81OROE%rlYl{a0Izf{AQt0_#w_=qGs6%-S4yPZr|H}LxQyS7hNPzj9|1b+_XrlYQn
zhzx(?1lwTn#awy8c=&JaRZ8~;Zo!x|Mvo7KF3i5TDyf`O?<I;zc0oI?%A%Y+AQiH-
zaNdmi`f;qXhdf!RKYihvI92ZKN-2SkYs)jQpqMLOt<vZ<dq<<7&If@t<9Q+wMW0^T
zz2;eRs|VxTrx7S2Rz%9}mVa$0`vcr*_L3Z45`lHyrWb^0or@5oTG|MM*h~hq#(I{B
zy@2FNnSG>+TIE+MYjylzdQ)LM<6k)l7*8g1G9~Q#wDQQF_yRqo_HU?_uReuHeZYy)
z{G}2yBxp+?Uo%}}m2BkVd4xqG^|>C3XZfdBDG?R#fka?AqW2cqFMmU~i28#~?)QBG
zX66aC_SMAC!|2a_gbE)R<-qgwf8j|a^?ED?r6jxa<K_ewvmiFAdn1<d#G`&WUj@u;
zumn+mzXt%lmuPeQF7*FioudR$537<|2dZN@wc_040%XLie1(nURL%e8T{A{ol`-V`
z*NoOtsJEnstYEua(tnM(2v&y05Mer|Q4GHX73iA-TH@YE51OHY{9^Gt_(sQEzT8in
z5c$-30$~>x!pZU`ZX#tNNAVk{DhkjV-Y^TQSO>WqS|=;WcDZg~86G7WtV|+}Ex1*;
zTkP?Wo$jCfCMITP5W^d7A)CqPZt6w*;`>>p?6~tIHl928%YV2m@)~y4Zf*CeD*#BQ
zj<AP^0>yoS^w9Eb=P>f3e<^;U;^9Mwu`piu5TQK(ze`m)Cr97#7>ht&@OfBF%)Ulk
zQfQ)2(HWdRh%oMa)Cved4?6(8Vz?01pC)1{<76(Hb0-c^M{ap~S~dY@O1TQoO_@w%
zz^L9gyXW3gsDE4{i60&g*<Uw#cNnHL^?dH)!yh0jf!n!S{c$a>2!Lp=Aolu0*5+6&
zjWyQpYT5X^2<oL8M_{Q6mr|kW4s7M#hr6$%m|&eh*B5<<=`e5ULvZ%`z0L(tom0Lm
z+W4$+ZF1K+MteEtm4?JeWmfLM6|-;QA&rP614~2-0DrkZv)^F8n><MS0ew)|IZN^`
zdG~-{c_45421r0@zk$gLIsq-<QF(=}OkGqvJIYn}OmN35u0gTaX04nI@0I-_=+!$z
zyry<H4lD?}6VgyEs=Z_US$G+c*2{%n3?@XueuxyDNwtj$sS^V-Px)B0hi<ld;t8VT
zs10rYcYl17jkpVK4Xki{+Dk+V#fHji33DqT8L)18Sox~C>rD-VY5-dQ4LLd$eC)id
zQP@m!RbGIL!XADj!8Ot|Nhgpso&4R|&wjj3zW9RXL6E?ed^$1BdU>agzr*CJZRa{>
zH;`qzG>7L45veOn^U!^q&}pBF%{0PAw%e9wRDWg_F@cmep=VIOvHD)D$oL-vTA`cd
zjtXeX74)v#h;=uBC@ugby`dUAX_gsbc)nmlz9U^QrAwB62MhwEBH-6vLzMp|y(`3g
zGJZP6X)eP;o%#m}_5$VrH~>)({@SglwbnQrWzC_cK2|wb=E#YcFw82*GI1Z8e+RTF
z3x7bNjVtm5SQVQjUJ}G;<8GsvZpAniM7i4ueci*t64Lc5ueMxD7>0#Mf>%{yD|`ch
zJDyM<UamMRH*ZEOH5+D^kNJ)F$@($EXW164ZqoaM{f@G6nb;ZahfH*7Z?)FNewFic
z7y05Z%rmf7T=TbO9;~>gXgs0i>@#~L{eL@hq`ZJ+_R9f}2oYeqr!~4m3fa`fI=&}*
z{-Vf{LgXG{z$kFhLA(~gTCQ9!Bm4pT1nI12a5`PP*l3_F`~eI(fZOG52MlEDD6|kp
z)y~6Ir)*I16^9^qOT3>Ki#KLG01bmgHO7^ql~fF8O>Wxv=iv;QBR)=|P};49ihuCM
zLA7O<Ad#>lyZ|iMoF}=Z52R$#bZyLybAr;7<4@;ez96{74o_A3_FJeP6`DsY`Gum`
z``fSST5SeKLBzdNdy#eCerf4KhSufkG^9Q(y@&y^%aJ|n7+9UK`$q=c`#Op}4cJPF
z>}vAUD8e;I$Q~S7hM#ih(Y9Uyj(?@P?;H1;PCNS`3v7*0)Dq$5DijybT0qm|GSiI%
zJ0bFZw{p^LJ-F;W6c?G}sxkVC!`m(}z-_C(;m)QK<0euVo=59#d~Sj<yIKK}^Mej=
zI8_#53tw9H*PbZO$AX!LSvn}k#lqA`N8R;M(@c%ExIeWhQ(hTPPC4H8`G3f94mWew
z<04`ttQ`MRv|WC(JMTksI_1SzbEdLU2hb#CD7S-bEa3=Y2FQpnBT3NZI(wF!qbUlZ
z*}xEQ+%wf}auXs0Qw;ypg-GbK^tzFg%nkZ>31-|4tAGWxXH55aKuEbRy^k5JIW@95
zez)hG6&7DZ+DyW7r}1z0xqpNS<DZj=3!a7xW9AA>h;FbV67|jR7U!~8+p^rk>n?X5
zkFT5<mi0~;6|JcTsf3&HR|cYxvQ@vx0iGHGw;B@V)oa!K4-NIU5lBw79ULOC*|4n~
z!y4HOF=U6&1a>~;NRPfv-`S2$Mn`6ySbs+MoO+l}X9<<DdM;mAF@H^%fg+-L##@&K
zV#q;^m)B+ba?2Kp>ljxDR-wm;8LNVP@(!;hR5{2hu8wQP%>Ab)cT_LP7UO7bRWaqY
zJ!i>KXj;f=u{+3h4q=KW4n9+VZJCnRCqdP+l|{XvQ2H;GpRxdaQ(E0M#OPDi*?B!=
zMpe;Y0XBS{iya<?qkm2g28dfq*9P13S>do^jFnhF9Y||Tiv+;j4^bCfp)m%N=9RxA
zR9HzARSkcCZuNsdt*VlCgz})ch8uoPT1D-+z#O^m0=z`3t#3nZ%8`7%KoSacr(QKD
zj5~XsBY2i-dr4G<<e$N%9Q(|^6a=#UPUbPS&5^?+wIO9hTz@h9VBo3ZJHrnl4xmG#
z?nD<g78WkL?_pI0vYy_R#h00S4mg~nyF*FU0pb69?Yz^4We%r_?xkD3ay?uBIu-8{
zue?ZD9r)K4eSPpV<l1KluAM%ks?k#B<raW-_xDFKS{>UD0DU{jC!c3)W_J|9KwkL_
z7e&dlq4)w^I)76I#ZTa-SPC#=o3i(+Ag-f-=6$iYaYh;&%Po{!xCQW_px&VHs&TRZ
z;KiVQQtXCU6Wy1KRj!?&P`G*K1IHfDEWo*Kg}SEw@eVYa>0k77xQ{SvT-R-Q#=se}
zq;IV`8Y7C>5_M?ZaMJw#r{wsUt@0Qwvp=o*O1GOOWPeNv0c+O0SeJB-nW}lok-Nt;
z4x^6M+HZyWsb&jNGnv~fu#!*qo`tc=kb3I@*S=(3ep8bIG>;S}w2;Ks17xw+$~=G&
zDEeNML6O><!*1N&L5<U}#;uq>oV<&2lsc19A|slpTGS@2avnKIpot79+vSc{7C+V^
zh>_U|D1YC&k`<om_s2>7IN_jnkzDD9b!|KNvte^2j8I*ptF=^7I*-F2MIQSzO;%!9
z)7+y&8ZaVw<UE|dNe+Vcms6|(j^lpk%(iEwhh?+ZHZ9sOg>9|g`OSp&G8I)0raY3-
zMsX@B$>wYL>f?WxYP{l4lC!Mb{Z?m_!+UT7mVdaXFQ`7Dwnv4GtUi)*PJkgGosLE*
z6cuTwCOCviNtT0@vM?fW8>W6Wm~Z`PXZmkzgf`(vi*^ipc-RmzDLBEk0`lnKl6LxZ
z5#L(bqcN~A`r;NbN_G<$?2&ujK@nE8f>5JX+L~)=BV~>jYJNf_{iYAwWNT$`YZ1P(
z1Ao1L?x23XMq<_9)Jv;!m)T-PjK(FbCGQ3lm9>?m>)Of3S{2<jd;g>0nA=MxNYo$`
zZ;0Pl_-;K}N~o8lfOarQF{7OKAyv5yW_k|HUdyJAWcrRRY$z~G<-+=*W`Oc7RppI*
z5KF@s3K!-$Ri1c2rAaq@4NQYbn`ZLP0e{6q2h2N%sKPQD529*wq&C`C4{<(<ka3Qr
zPy#*^jn75iy_&1><Lozuy%)!fwKqR%RNZ+YnT2tS86)a8YOR3A$u)0>Ad=yxW>Qp$
zHprd~dkfmeHQCbU4}Vo}R*~Q}C;{YF{T~^Ya*v=A{$bj{8<>BZpzYUFf8xBt9DnK5
zFS34R1j}u~OD;xv!BO{q!aXAXMV<aNGB8zA#@1cE0*T^8x2gC?vN`}v&s6P0+{!bz
z{}wdlGQB2OEK>Ris=*I>gf~2JDkNshbZ#^;2-@EdzNHJsSpwSh`k(qEWV;y*YTe8v
z5uJqodYq`EFd;bMktN0vz&3zt{C}%oaY<)Z3dJ%Ox_JTg$_cZ~({eVKs@F~O6B*%9
zoz=v_jz~-f1wf-VkNKfk58PCorzCs^H*J4!6ZulB>{Q~5dqvYr@MdA3Q92vqnr60M
zGgjD9MkgFv>SstsN~p-r>De>7J3u~Sub4=-hAMcggQnIAf`?TPoXuk#6@MnpA5SFw
zXT6fg1xRQ-?Elw=H-7+cZt~s(3K|``2%P(P8(RW++W&Lw)JB=Rfl27Om>Zgq-`*q8
zgGZOs_oq6{4!Tx9^6wv0nCQkya#lP=NGEVLiy%a#IrbhJF$4GH#HCzPntANj9j*X$
zSwZNxFn<ZODHlG7=XGE?Vt>X9(Ir&WoB|XPdX6H$SjZHdZHe@4h2@MaEJ_|J2AS8U
z{4P0{Nii6mJ*YaF1Zl2m6`DVX#HwL33rZjn8+uZ!8&IbHD1ZAf<$7Pram!Esz{&0?
z>X)udXoZ=ubs!&r#2XuhG>LZGk-0ZXcwx6{Aux=dGDFK3U=ljM5r4Tlu@A{u&y6y$
z6JrQUU*}3D_v(E!1OtY+)f~7!mSVHmFUUmIoKXQ{+3WDvgyq~n9dDA>#9Am>dR;$I
zvhHM~kW{S^utMBP1(f6lXOs3<nyUiOuNlr9bHibFCMOU%cK_d^kzr$Pg<!%*V6+iA
zg%^+q?<}^;o4Juce1BlMslzIQ+GTY^c{)~Hm9Nw-?Ay?t0YOYK1#-gJ?xZILB0LVk
zruQ>4&QU&rpPNJLz*V%=FO#>gwBw4-1Z40HCx83!oT%|L^&~O8vw&BnNP6jPe|ur%
zvZCNaL8_5F5Ob8;KNPpYGYBw%Uv!wODEc}KQSJW?D;m+2bAQE83BgvJh2^83Kw+YP
zJ+XFK1A=z&xp?gBuRJhb^oP(Z#g<=9!6gqq=o%D|cvkD13Xv>A!DQ~QH#=*p?B#Dr
z1uj#`1ZM$g1bbhWC8S=jD_Geh1I-IxT5{H|@P`;fzFdi;Jg@0iphwKk5PnS_5eXkg
zQwM!ED!;zuIe)}89W7^<VH@bvUM4(ws^g$(|1Xj8CX&^q5w7op_6@YUI3tbA?A<qS
zvp=qRI`ARJHsna%hh9{dqEFpUT|mk7lT&Wcu@t_TuykGIw9|_wG$N+W!?RYU*(NaY
zG1&8*$3X%isUonFCIxMqG|%WCZ+KcNtMpM${h7+A$bao5@x&Lj-<g%nSG5eiTlJf0
z5sj!vV3;dg+${dfA;n>XImsojlUa=Ozihxk8C8G9C8jRs9opl9K2hARnYd94GD2+w
zO)oWZr#sTI?%`1`9OtLCt?>JO6)Jl5@l@3&wWfK2aqzl3dQ?Wi_g3b;$xUX;u4L+V
zrQ39qr+*EO(xq6@W)<Bjn$Y>~r60?nt()XupGs8+ka2SM{eur*Q5JkidjztT*1!tb
zP*A{cMxW;l#>0u_0)x4|H3B}L{9#jUJo?XF`S4eH)-2>w%o(-P_9Sqe?P6|TU%ZDL
kN2F=~G3tu%dQLx}tMi$_4Jk+EZmm#wB4tRE&jVyOV4{os6#xJL

delta 4815
zcmV;=5-{!RCf6sBcmc$bd6g2(ZDe6|5&#MYI3@CWRtYk<C6gcl6gtMscSs7cU=(?}
zj}1$o06ig|6kEv1a4A*A=?An<fslv(0ZGWicn7=@iO7T4h}s4_vsAJ#k5s*NlWPGW
ze>yrBZtbArEC)UUwN5eFA1p&AI9!r3M<Tz0hD2Vn#|adiNt7hB65JY(GGE+!ypiU8
zYPKvPV6=UG8Oek7t_%+OjqfDR!5HW*p45cC7$ztg4uF0|=C_2Wu4%CeRaC?6UO2s~
zNaHFdukPxkZK%X>{p4{QJXFbaq6t>De<{jC>B;r0TG{2{`u4{zI@~{jQo}o&_u*^-
zfW=PBboc|d%Q4Luue8LPjU1W7Iw#in%gy+(X=8NcC9_kptG${d6Ol#mNo>z~r$$1E
zcO|bAda2>)-U1z;d2`h&YGSp-#6jx)f|l|EF3rY0d-5dn_<eg_+b6211jdU3e+P0?
zQP)Pq20!rvZLoM^t~}tpdODy=qQ{_uOW?zKjrz(-hvd}03VbJLq9+?L!ma;yqH!5X
zZM&$2t<|XW(>7J-(D3NTG^|wkYM$&S4)DAlZEN^0*eB$y1qZX)vrzUi(?2_~6Azd4
zhMjkGJnD73FY1kcaIEVu=TBPie=DQ&smC?<;er)2_<Oe14dRYiU>I91Z3IE=CIeaH
zJxfGhz;YzazS2c4a;ucJy8bV{DX^Y#ubhMoCzCmu683#sd1Oy~0UpwOH`GekpF*TQ
z;6&*DQi&N7G$oI(nXa+QwsLVi!XlA++>b>w{L`zHh>G{XqA(oMdy8xrf1%sNeL<%8
zd%l3Pa|GJ^YT{?%^k=@p1rLmJ;CcE#@T8J@y%qw}l3n@n^8yQ5kQ-G!k;{1EQNJ9o
zg61|@0w}-VgMePkv^o8kdVjA@(Sj%k)yXXb)iIn}@osT}GGbM}LdNl`X8-c8nWHVr
znDTt<#%n0lU*g8cSHiFne@5H{D??(4Fr8B<hF^jV+)1sR;`bwm%}~JpF?gN)BV(>#
zZYRx%eCj-bFpG;}Wcd>}5i*dY_>I$*251at7zNcV1Kf?R6P4sUT(>X`j}n)bCJ{!K
z+$!6x_ISun_fP&46EiaiVU4zs&E)g9bt3)oeXP><TzQe3PaXT^f7}*%4LfSLHv80-
zfFx5#SVO~sV!puoXn8hsn0Zk@l)q5%aG}H4m@j*XP@aF^rK+5hqwn|(MW8QuJgg>W
zUcqkD6gK<GjLsiK7<WEu1q2`moq%4kTnK8<lQ9(WvKLJ`lZPlHw>-Tq8vwH<T!m*Q
z%%(BmRBs#I^Y1BCe=ZS3kB<jzubaHPj8htVzISn9kB}8W?cA+?xR%!hKr~kndwn76
zb1W7{n(KEpZ2Vn>byAHZuvCRhpyjMg^|UVRpykKAoYF<X5lUP((bA3?Sv3yKWl8AX
z*tL8|3T6;!uv2qC%<%j}kwH$LsQOrAAX0zP?NbcGB*xL~f5r&k-P*Mw+0XeD6&39%
z`rGk2)K5|+?T>7AZExC0{9N9_)QX7xh~);-$P<<mE1@=U<R}J>)!}ZIUHH(!$89sj
zS>b;kG;_RLRSZnKd$+@bRN6C@<Cl~Exv5#v2JTeXwL|NjKNdx=b=<**+xS>0>6(}M
z7Z_CotPSCwe<AVzKdDWO_qqZ4Vooiti&ex&xzOP!AIGP;@K4L?_ToyL<is*NHce+Y
zK+t(ZT%Po?5W&x?*vZDqRbc#n1$nCb3{i915uZl)jdr;EgNs|%Bsrt-JZ`4l$mfsY
zSRLCW1hcUSXS;L!{O}w!QX<#cx0IoV*5P)ifiHvGf78U3zTT*iSLC>nji!8P2z5Qe
z_1>Kr#m!s^H(ky@rghW>`BQ8gVw7m@rdVZ#;`xCJ_>FYJl`dKM954!ui-TQx4paP=
z^sf={$@uFPq`M6Ycjz1^*bA5d-~mKG`)anH*I3|fmo|o&`B>#&n<6G$!!WBL$;5tX
z{2tJxe=P!rG_S}JU{-9Ar?E!ma|TIy6nS+5#TE0w<ZvaaLex3GTdLqpphE^$#_0K%
z1VbNoKdV}@X;j8N30g;*7!0U#*5BUvY=Taq^C<7qzJZ~w`NC(}7OZa4`<4ipe+UuT
zL^0J9#mXs@mJxAdDu0cjXS4#xoAx*^=boynf9883YI|`~o-$_UqJOtezmk-2giN6y
z9&4LDqyYZiTVTS{Z+bSWNWpGSPe!#qO!)D&T8pH$)vU74Y3NRTj%4rVZZ|~;OPj_H
z*}{`E0F*};EaAhcuuzf07;_E~4e|0HSmS1S0rJJy@;s8F=NHmgrwo)f%$9r@qS&Dj
zf8Ew?y0lvcf4G)3NMBsosqhWl_yZw^H-!;oY2v6VgjpnC5_@bbfU!04Op4=v#kDpj
zEdD1f^~=NyFBvNYK?$_|nY+IqcC_8m(}Ssw7qv{2au{buz@YXzS}AtVKX({61a^h@
z8_QsEbKyvf?r_-ROIo*H`pjxD-$h^Bf695@OsQGViN0lc0=4)PySv(33dtiou5F_#
z*uL3yb~;rTTzSJ9NXN3%E05BW5f+aYG@i7GO2<Trouut}L&PD5HJ-q8I$2Kihy9qD
z&4s{lO{VR{R-D&}`Py5v<F}YZv;u&z8c&gh5Xx!EkpA@tB%vr;P*JW>g{v)3f1A(b
zk;AaCyt=HE`+;U)uO13q%|m<S=;KUi059nD5?ODCkVzqy#wGiB0lUriVA*jAwr%nW
zh!kxVXWG^s^k+$|=<6Is@X?ravJc)&Yr-)NNtmYVx5^e>?7crMROdqIeb(d<22YCq
ze`AkGW+HG*9^l2DU|JswCcFhEe+*OyIO+5sbZ*m_c^p52V$Tdd@I(q@*QkmA{M+z@
zL`8aWeGI7=0^UuL$L<cf=q|hE6jo4#sk|3}6VV5yseye8!d1w7F{aoes%O-8*YVot
z>cUJ&_}8BCOfB?=a8-^^GWCiX7nK_RD+`Tqf!*m}4m$ZK*;7ZO>8b}se;n_Afb0xj
z>j?{%7#iN&?pL94A~ne&<L2HPf?8TS;@^rtb~SD6RWI)rC2LMDwuWY1>L)Aqbn820
zq*`^tquOM*T+zY(qy*r@gSP~RoQi3t(y29Nn(>a~O%p6el3oS{l#HT711l@FP<0)W
z5`!@QAepjsF72IoZ$7u(f1!TmT@H(8$AS@>#Zm%gT@pD~#i}gWIbU1;^bUC3A48dD
zd(I8aB`wQ}Khi+iZvH1Ln-*tQVe?W2UPljA5P%?&I3@a)DqHh^hJ=}pw~W-$DJwf`
z^rjbe;)ZSX!FGXdv~kTwhiV{o`&onD^jAMH9dRo{{XU!dCZ+E`f2?GlED5#rEsiC%
z1D9VnXAX_~m0II1mqyVQg!OK1k|OVYODtASM47s#huEK5)nq|CsJ_K`GD_c{)ZAKg
zw(EAb_^u)gJ-KQvzTcB&)~Moe2Eb6D3t!0+$+aP!Z-fEWw4E4oGTXOS<X!LasdtWo
zwK?I7`&`(mLn2!he_e>3OnNYNvasI+b>?=WpdNzQgwl3`Q~^68=}hv@JO+=4xMnW;
z)4UUe7X{5IAu7U~Zi?Ix9BeOfn<UU4*BTj)W#j}a=-eWe(Ht$5Iuqn`yRsGpahFHY
z887%S6^#;<g#&#wX#jyZs>`7dwiAve#9QbR?0F$R;(}d2e^R2zo~I06qr8V_dEpr>
zDC8DAgLl;M5Y8?E!(v*|fuxCB?#gsXtGHZ$S;^bakcV>jM!l8a_LlB`fNscrrF~}C
zzye~)9QHGs)?VjagHw207%q|4&n49dF7W1{vkXIRs}T~hr#mtqo-IfQ=%|)n!{jg1
zkxl124Mq{<e}B6b&d7CSebhV6qm;l&ut#{;c*HLPZBAsD2fo&Xy}hSb-$XLJXiByU
z=-?e#wfnNe0E0<OiqpOV?*oYRI}G8IUeO`B#t;EBOoVEdrt<r2Z+e1zW^y6Ip|+Jc
z_Q^F1zSP5+pb_D=mB@GnfRl(Ch0yvad@$%BUw;s1e~~1e0Odod|49hmn+<VXA^4W6
z>tW>O88={3<viR_^_amh=Wj<08G~oP-jvt>{2HtQQFjq?6<u=v5CSrKpCk4bd%B~(
zaRSeFwm_&`cBo|={+;tO!3#yx<|Rc(&H-q57m#VI{=aq-$ZY9nI1EhFh*-QHRm$ZL
z4cC%4e?H!EjYh3&!xK*Oqhl{WN37DcXYza_?FxN*3S0V_0mzBlCPAf~m^bJ%I(Sn2
z8=bRd%SUQ3*iTRsZiAQ9l3;Q%j@+L=2dT)Yn{QWaZ-vWI%;-<d&ljk{%Iw_NeT(ux
zn5RP$S|2CWQ}f*Uk-WHZMy>y)W2-;MY!i`re^0)t6NQ6Yowq@dY{Qe)_m=p$v`SUR
ze$mVcDbV4Ld@pSS;3N4Tw8``XzO0O8fHG_m<NT;!+Hl=L<r?h_UPMD>sr7Wh#)y=G
zsNaMBMA3sS@hDfZwlPDdoA;P=WDYCIWq6Qtknq~?)(CkWrJ2Qnk&X`N;$S!;@On!0
ze_(ZfX`QN-ds1_db;%u0aqD4ur4pMM-PA^t!)e|G#>7+waBTxRw9QD+#7u_?8>B(q
z_6F!kRt-O)qJnT*69SC?pdE^aTj_#hdW1>wB2?D3(Q1-^{0~e2`jTc65i|V-uPYke
z5+R->=PU_8?+Ns13)~$@(eOUTNKea4fB$n4;G6>_xDaxUBM`h8HrHq<>eLfPy<XyV
zXNuTbAoeP2dSU?o_-rMeR>FY_*WuMwNDim{$Ab~emNObdb5(vw(E%=B7cLPcSHLRC
z1{q2z9``wbHK{+3{s6z}6xBE`DcKfoY(Khe-T(EeGBbmzz6w#ho)omhFZsHGe^Ag`
zTNC<mk*Jp-dOZqz7EP;|0w~2dMS;mCn!JNiC6{#&2}oD>3|k+rS%o()?>PnC;?1yC
zB;)JHyNZIW^dnp=8wV+bOV2R2ynpZf4S|zhgPmAEj;@Yyz$VI)8kI4|{_-}Gl@>d|
zbjTM4mhn7p%QTt*PcIq@6lct&f3;hakDy||Hv^$*tB6vQ=WSSU*&6Q(-68JrD-~L?
z%CDKTuf+cp3tNXrl*P&CMXD0d>TPf6Njey>08Dc?BRX;pXA8}Q**p9zUZjDxmzRe|
zyKGGkpSf<0doMUO`Y3hjI4*RQgwDxkDzL$z<eS2_mwCZ@#>e^#9oxi4f4nxY8^zi;
zl&Ae5HsQBd7x0XtSnJ_Bp5xnheP_9w=!yZz$wHcwZMy2un4_PdT;Bl!OX9PPQAWyh
z<%XRtd1@4Hk`9ztv}mYHHk<xoKreUMT4)O^5wEYBGbGJxRBMi{FC_PuwT<l|=kcr2
zJk^<neaq|2JBcry&)#=Ye;%S<G;|n=j}LGO?<0xvS{nig_Z1?^x2=0?*2U7l(hDlP
zeBB9`SATHEGWRtUt*{)7Ju{gFE<<3wgwP}d?sVX8VE(vCv#vIeHDtPKHBmfMh>OzD
zq@aCQZP^9}2o%Y+B#8O{tm0et>YRD=w%ska;em>zo7}wyi0zdWf6E>aU=fGyHh`q!
z#n<$29340VX@LB4KC(MU9&NI{dQOp(3(CG|Ou=>t++dGU70usRBqW1Tk+4%0DH(qT
zWML)56)kN{@ieO)#Y~{)m=3}FC@w~2kf>qfQGopad}#7~*XXwDj6_-I`8v^p)yHeY
zXr`H+Z-CiDS=rzIf7hfTOgEH}ZyLX0@hEHgl0_TGt+B`QP1?*ul_$XKeWgsZ$Vz*A
zLW0tMn)*YwNLaEs=oG2u0)yj+(N{CnWMb}+8qR|3jKV8hH=|N?jD^*v3bDJt|197t
zPcRzfE2vv;%+k~B=q0YtDvU+B>Rpx+>4Nhib^~zxSq7hHe|CA$b30b|5QhpJk$*|}
zfHe;au&a~9zW`HgJ#RQ4ACPOG5D%6X!7{sIu*u#a-%9&64a4UbgBm1`ppn!;QQCLp
z92PYhD?Ez8ihtv<QH){nkTa05FzOk{L^vbQs%=<W_(R<>G0>@YR$XF@#OW1bevq~C
zejJw|SZQehf31G;(Ff7Kc*QoPOqg7Ck8hMP`eG?%!OTSiC8keUyltCmZSK*kX@4sD
zz~=VHhhfQT(+us#Ge~f$NpUAXyp_DeV-Iy7Y2Ch*N;3I3s)|m>3gtodhXh?gy@nVD
zd;n|!_NXbvq!ga<Um!FXQuLZFDZkzF5whyqTizRZZQ*U!&I}D*1XJ9b4(T^)MB{Wz
z42#lDQ3bLo;!sgeqQDXA$W5h{#N@qoUylX}zOmB$M{WjEqdr<b*VS)GbkbMuPP#NG
pmz0USaTXV_ad(I~s(FF<?6%J`T(e(d7=-MF*JO|T+2!xfe1Hh{Wj_D_

diff --git a/README.md b/README.md
index f9149217..6f7c03c8 100644
--- a/README.md
+++ b/README.md
@@ -112,7 +112,7 @@ If you intend to download the scripts from a
 different location (for example from github.com) install the corresponding
 certificate chain.
 
-    /tool/fetch "https://rsc.eworm.de/main/certs/ISRG-Root-X2.pem" dst-path="isrg-root-x2.pem";
+    /tool/fetch "https://rsc.eworm.de/main/certs/Root-YE.pem" dst-path="root-ye.pem";
 
 ![screenshot: download certs](README.d/01-download-certs.avif)
 
@@ -120,11 +120,11 @@ Note that the commands above do *not* verify server certificate, so if you
 want to be safe download with your workstations's browser and transfer the
 file to your MikroTik device.
 
-* [ISRG Root X2 ↗️](https://letsencrypt.org/certs/isrg-root-x2.pem)
+* Let's Encrypt [Root YE ↗️](https://letsencrypt.org/certs/gen-y/root-ye.pem)
 
 Then we import the certificate.
 
-    /certificate/import file-name="isrg-root-x2.pem" passphrase="";
+    /certificate/import file-name="root-ye.pem" passphrase="";
 
 Do not worry that the command is not shown - that happens because it contains
 a sensitive property, the passphrase.
@@ -132,11 +132,11 @@ a sensitive property, the passphrase.
 ![screenshot: import certs](README.d/02-import-certs.avif)
 
 For basic verification we rename the certificate and print it by
-fingerprint. Make sure exactly this one certificate ("*ISRG-Root-X2*")
+fingerprint. Make sure exactly this one certificate ("*Root-YE*")
 is shown.
 
-    /certificate/set name="ISRG-Root-X2" [ find where common-name="ISRG Root X2" ];
-    /certificate/print proplist=name,fingerprint where fingerprint="69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470";
+    /certificate/set name="Root-YE" [ find where common-name="Root YE" ];
+    /certificate/print proplist=name,fingerprint where fingerprint="e14ffcad5b0025731006caa43a121a22d8e9700f4fb9cf852f02a708aa5d5666";
 
 ![screenshot: check certs](README.d/03-check-certs.avif)
 

From ced6bf2c1100363bde01ed3e9430aa6c4c5f7fa5 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 15:54:57 +0100
Subject: [PATCH 6/7] INITIAL-COMMANDS: update for new Let's Encrypt CA 'Root
 YE'

---
 INITIAL-COMMANDS.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/INITIAL-COMMANDS.md b/INITIAL-COMMANDS.md
index eb06ad29..c823826b 100644
--- a/INITIAL-COMMANDS.md
+++ b/INITIAL-COMMANDS.md
@@ -18,9 +18,9 @@ Run the complete base installation:
 
     {
       :local BaseUrl "https://rsc.eworm.de/main/";
-      :local CertCommonName "ISRG Root X2";
-      :local CertFileName "ISRG-Root-X2.pem";
-      :local CertFingerprint "69729b8e15a86efc177a57afb7171dfc64add28c2fca8cf1507e34453ccb1470";
+      :local CertCommonName "Root YE";
+      :local CertFileName "Root-YE.pem";
+      :local CertFingerprint "e14ffcad5b0025731006caa43a121a22d8e9700f4fb9cf852f02a708aa5d5666";
 
       :local CertSettings [ /certificate/settings/get ];
       :if (!((($CertSettings->"builtin-trust-anchors") = "trusted" || \

From 7716bb9d6c1830c010f5d14e58191ef2e459a624 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 15 Jan 2026 16:05:33 +0100
Subject: [PATCH 7/7] fw-addr-lists: rsc.eworm.de requires 'Root YE'

---
 global-config.rsc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/global-config.rsc b/global-config.rsc
index 9c35d13f..e55d9830 100644
--- a/global-config.rsc
+++ b/global-config.rsc
@@ -108,11 +108,11 @@
 :global FwAddrLists {
 #  "allow"={
 #    { url="https://rsc.eworm.de/main/fw-addr-lists.d/allow";
-#      cert="ISRG Root X2"; timeout=1w };
+#      cert="Root YE"; timeout=1w };
 #  };
   "block"={
 #    { url="https://rsc.eworm.de/main/fw-addr-lists.d/block";
-#      cert="ISRG Root X2" };
+#      cert="Root YE" };
     { url="https://raw.githubusercontent.com/stamparm/ipsum/refs/heads/master/levels/4.txt";
 #     # higher level (decrease the numerical value) for more addresses, and vice versa
       cert="USERTrust RSA Certification Authority" };
@@ -127,7 +127,7 @@
   };
 #  "mikrotik"={
 #    { url="https://rsc.eworm.de/main/fw-addr-lists.d/mikrotik";
-#      cert="ISRG Root X2"; timeout=1w };
+#      cert="Root YE"; timeout=1w };
 #  };
 };
 :global FwAddrListTimeOut 1d;