Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision 542d478051d9a047bdce6929c088a2a72490bc75)
+++ introduction/welcome/changelog.xml	(revision 1ac799bd728328e3be4878c4a1205faa4bd21129)
@@ -46,4 +46,11 @@
      <para>July 4th, 2017</para>
      <itemizedlist>
+       <listitem>
+         <para>[dj] - Use PKCS #11 modules where possible with gnutls.</para>
+       </listitem>
+       <listitem>
+         <para>[dj] - Update to GnuTLS-3.5.14. Fixes
+         <ulink url="&blfs-ticket-root;9444">#9444</ulink>.</para>
+       </listitem>
        <listitem>
          <para>[dj] - Update to Node.js-8.1.3. Fixes
Index: networking/netlibs/glib-networking.xml
===================================================================
--- networking/netlibs/glib-networking.xml	(revision 542d478051d9a047bdce6929c088a2a72490bc75)
+++ networking/netlibs/glib-networking.xml	(revision 1ac799bd728328e3be4878c4a1205faa4bd21129)
@@ -106,7 +106,7 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr                                 \
-            --with-ca-certificates=/etc/ssl/ca-bundle.crt \
-            --disable-static                              &amp;&amp;
+<screen><userinput>./configure --prefix=/usr             \
+            --without-ca-certificates \
+            --disable-static          &amp;&amp;
 make</userinput></screen>
 
@@ -127,7 +127,7 @@
 
     <para>
-      <parameter>--with-ca-certificates=/etc/ssl/ca-bundle.crt</parameter>:
-      This parameter specifies where the trusted root certificates are
-      located.
+      <parameter>--without-ca-certificates</parameter>: This parameter forces
+      use of PKCS #11 modules for TLS certificate validation instead of a
+      bundle of certificates.
     </para>
 
Index: postlfs/security/gnutls.xml
===================================================================
--- postlfs/security/gnutls.xml	(revision 542d478051d9a047bdce6929c088a2a72490bc75)
+++ postlfs/security/gnutls.xml	(revision 1ac799bd728328e3be4878c4a1205faa4bd21129)
@@ -7,8 +7,8 @@
   <!ENTITY gnutls-download-http "https://www.gnupg.org/ftp/gcrypt/gnutls/v3.5/gnutls-&gnutls-version;.tar.xz">
   <!ENTITY gnutls-download-ftp  "ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-&gnutls-version;.tar.xz">
-  <!ENTITY gnutls-md5sum        "4fd41ad86572933c2379b4cc321a0959">
+  <!ENTITY gnutls-md5sum        "1e84b57a472b5f3b01f2c1b7a3a2bcbe">
   <!ENTITY gnutls-size          "6.9 MB">
-  <!ENTITY gnutls-buildsize     "121 MB (add 44 MB for tests)">
-  <!ENTITY gnutls-time          "1.5 SBU (add 8.9 SBU for tests)">
+  <!ENTITY gnutls-buildsize     "147 MB (add 42 MB for tests)">
+  <!ENTITY gnutls-time          "1.3 SBU (add 5.0 SBU for tests)">
 ]>
 
@@ -143,5 +143,5 @@
 
 <screen><userinput>./configure --prefix=/usr \
-            --with-default-trust-store-file=/etc/ssl/ca-bundle.crt &amp;&amp;
+            --with-default-trust-store-pkcs11="pkcs11:" &amp;&amp;
 make</userinput></screen>
 
@@ -181,7 +181,14 @@
 
     <para>
-      <parameter>--with-default-trust-store-file=/etc/ssl/ca-bundle.crt</parameter>:
+      <parameter>--with-default-trust-store-pkcs11="pkcs11:"</parameter>: This
+      switch tells gnutls to use the PKCS #11 trust store as the default trust.
+      Omit this switch if <xref linkend="p11-kit"/> is not installed.
+    </para>
+
+    <para>
+      <option>--with-default-trust-store-file=/etc/ssl/ca-bundle.crt</option>:
       This switch tells <command>configure</command> where to find the
-      CA Certificates.
+      legacy CA certificate bundle and to use it instead of PKCS #11 module
+      by default. Use this if <xref linkend="p11-kit"/> is not installed.
     </para>
 
Index: postlfs/security/nss.xml
===================================================================
--- postlfs/security/nss.xml	(revision 542d478051d9a047bdce6929c088a2a72490bc75)
+++ postlfs/security/nss.xml	(revision 1ac799bd728328e3be4878c4a1205faa4bd21129)
@@ -210,7 +210,8 @@
     <title>Configuring NSS</title>
 
-    <para>If <xref linkend="p11-kit"/> is installed,
-    <filename>/usr/lib/libp11-kit.so</filename> can be used as a drop-in
-    replacement for <filename>/usr/lib/libnssckbi.so</filename> to
+    <para>If <xref linkend="p11-kit"/> is installed, the
+    <application>p11-kit</application> trust module
+    (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
+    drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
     transparently make the system CAs available to
     <application>NSS</application> aware applications, rather than the static
@@ -222,5 +223,5 @@
   readlink /usr/lib/libnssckbi.so ||
   rm -v /usr/lib/libnssckbi.so    &amp;&amp;
-  ln -sfv libp11-kit.so /usr/lib/libnssckbi.so
+  ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so
 fi</userinput></screen>
 
Index: postlfs/security/p11-kit.xml
===================================================================
--- postlfs/security/p11-kit.xml	(revision 542d478051d9a047bdce6929c088a2a72490bc75)
+++ postlfs/security/p11-kit.xml	(revision 1ac799bd728328e3be4878c4a1205faa4bd21129)
@@ -143,7 +143,7 @@
     <title>Configuring p11-kit</title>
 
-    <para>If <xref linkend="nss"/> is installed,
-    <filename>/usr/lib/libp11-kit.so</filename> can be used as a drop-in
-    replacement for <filename>/usr/lib/libnssckbi.so</filename> to
+    <para>The <application>p11-kit</application> trust module
+    (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
+    drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
     transparently make the system CAs available to
     <application>NSS</application> aware applications, rather than the static
@@ -155,5 +155,5 @@
   readlink /usr/lib/libnssckbi.so ||
   rm -v /usr/lib/libnssckbi.so    &amp;&amp;
-  ln -sfv libp11-kit.so /usr/lib/libnssckbi.so
+  ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so
 fi</userinput></screen>
 
