right.

I think this would be better run from sysmerge rather than rc, but there is 
also a discussion to be had about updating cert.pem via syspatches or some 
other mechanism, which would help direct how/where this is done.

-- 
  Sent from a phone, apologies for poor formatting.

On 22 May 2026 21:34:08 Lloyd <ng2d68@proton.me> wrote:

> One more thought. Don't you still want cert.pem in the changelist
> even if it's dynamically generated? Otherwise changes to that file,
> while ephemeral, would no longer be caught when security(8) runs.
>
> Regards
> Lloyd
>
> Sebastien Marie wrote:
>
>> diff --git a/etc/changelist b/etc/changelist
>> index 0dc0188b18..6da8ad922e 100644
>> --- a/etc/changelist
>> +++ b/etc/changelist
>> @@ -148,7 +148,8 @@
>>  +/etc/ssh/ssh_host_rsa_key
>>  /etc/ssh/ssh_host_rsa_key.pub
>>  /etc/ssh/sshd_config
>> -/etc/ssl/cert.pem
>> +/etc/ssl/cert.base.pem
>> +/etc/ssl/cert.local.pem
>>  /etc/suid_profile
>>  /etc/sysctl.conf
>>  /etc/syslog.conf