Hi, the openssl package provides the c_rehash script which creates the links from XXXXXXXX.Y to the actual certificate in /etc/ssl/certs/. During the transition from 0.9.8 to 1.0.0 the hash (for the X part) changed from md5 to sha1. Since that transition in Debian the c_rehash script provides both symlinks: the old hash (md5) and the new (sha1) one.
The c_rehash script is considered by upstream as a fallback script and will disappear at some point. The recommended way is to use the "openssl rehash" command instead which appeared in 1.1.0. This command creates half that many symlinks (one per certificate instead of two) because it uses only the sha1 hash. There is also the -compat option which creates both symlinks (and behaves like c_rehash currently does) but as explained above it should not be required to use it. I am planning to fill bugs against 23 packages which use "c_rehash" to use "openssl rehash" instead. Here is the dd-list of packages I identified: Alessio Di Mauro <ales...@yubico.com> yubico-piv-tool (U) Antonio Terceiro <terce...@debian.org> ruby-openssl (U) Christian Perrier <bubu...@debian.org> ca-certificates (U) Cyril Brulebois <k...@debian.org> debian-installer (U) Cédric Boutillier <bou...@debian.org> ruby-httparty (U) Dain Nilsson <d...@yubico.com> yubico-piv-tool (U) David Bremner <brem...@debian.org> racket Debian AppArmor Team <pkg-apparmor-t...@lists.alioth.debian.org> apparmor Debian Authentication Maintainers <pkg-auth-maintain...@lists.alioth.debian.org> yubico-piv-tool Debian Chromium Maintainers <pkg-chromium-ma...@lists.alioth.debian.org> chromium-browser Debian FreeRADIUS Packaging Team <pkg-freeradius-maintain...@lists.alioth.debian.org> freeradius Debian Install System Team <debian-b...@lists.debian.org> debian-installer Debian OpenLDAP Maintainers <pkg-openldap-de...@lists.alioth.debian.org> openldap Debian QA Group <packa...@qa.debian.org> sendmail Debian Ruby Extras Maintainers <pkg-ruby-extras-maintain...@lists.alioth.debian.org> ruby-httparty ruby-openssl Felix Lechner <felix.lech...@lease-up.com> wolfssl Iain R. Learmonth <i...@debian.org> scapy (U) scapy3k (U) Internet Measurement Packaging Team <pkg-netmeasure-disc...@lists.alioth.debian.org> scapy scapy3k intrigeri <intrig...@debian.org> apparmor (U) Josip Rodin <joy-packa...@debian.org> freeradius (U) Klas Lindfors <k...@yubico.com> yubico-piv-tool (U) LaMont Jones <lam...@debian.org> postfix Laszlo Boszormenyi (GCS) <g...@debian.org> sx Mark Brown <broo...@debian.org> xemacs21-packages Mark Hymers <m...@debian.org> freeradius (U) Markus Wanner <mar...@bluegap.ch> courier Matthijs Möhlmann <matth...@cacholong.nl> openldap (U) Michael Gilbert <mgilb...@debian.org> chromium-browser (U) Michael Shuler <mich...@pbandjelly.org> ca-certificates Michael Stapelberg <stapelb...@debian.org> freeradius (U) Raphael Geissert <geiss...@debian.org> ca-certificates (U) Riku Voipio <riku.voi...@linaro.org> chromium-browser (U) Roger A. Light <ro...@atchoo.org> mosquitto Ryan Tandy <r...@nardis.ca> openldap (U) Sam Hartman <hartm...@debian.org> freeradius (U) Scott Kitterman <sc...@kitterman.com> postfix (U) Sebastian Reichel <s...@debian.org> python-paho-mqtt Sebastien Delafond <s...@debian.org> mitmproxy Simon Josefsson <si...@josefsson.org> yubico-piv-tool (U) Stephen Gran <sg...@debian.org> freeradius (U) Steve Langasek <vor...@debian.org> openldap (U) Tatsuya Kinoshita <t...@debian.org> wl wl-beta Thijs Kinkhorst <th...@debian.org> ca-certificates (U) Torsten Landschoff <tors...@debian.org> openldap (U) Sebastian