Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision 673c07088ddf22a6010d2e5e60658c0437a62fbc)
+++ introduction/welcome/changelog.xml	(revision 6133936264a5356a07eb8f2d081b5ae2c295788d)
@@ -50,4 +50,8 @@
           <ulink url="&blfs-ticket-root;15410">#15410</ulink>.</para>
         </listitem>
+        <listitem>
+          <para>[dj] - Update to make-ca-1.8.1. Fixes
+          <ulink url="&blfs-ticket-root;15475">#15475</ulink>.</para>
+        </listitem>
       </itemizedlist>
     </listitem>
Index: packages.ent
===================================================================
--- packages.ent	(revision 673c07088ddf22a6010d2e5e60658c0437a62fbc)
+++ packages.ent	(revision 6133936264a5356a07eb8f2d081b5ae2c295788d)
@@ -20,5 +20,5 @@
 <!ENTITY linux-pam-docs-version       "1.5.1">
 <!ENTITY libpwquality-version         "1.4.4">
-<!ENTITY make-ca-version              "1.7">
+<!ENTITY make-ca-version              "1.8.1">
 <!ENTITY mitkrb-major-version         "1.19">
 <!ENTITY mitkrb-version               "&mitkrb-major-version;.2">
Index: postlfs/security/make-ca.xml
===================================================================
--- postlfs/security/make-ca.xml	(revision 673c07088ddf22a6010d2e5e60658c0437a62fbc)
+++ postlfs/security/make-ca.xml	(revision 6133936264a5356a07eb8f2d081b5ae2c295788d)
@@ -11,6 +11,6 @@
 
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/releases/download/v&make-ca-version;/make-ca-&make-ca-version;.tar.xz">
-  <!ENTITY make-ca-size          "28.5 KB">
-  <!ENTITY make-ca-md5sum        "e0356f5ae5623f227a3f69b5e8848ec6">
+  <!ENTITY make-ca-size          "29.8 KB">
+  <!ENTITY make-ca-md5sum        "957c39206ba0e9139807c5a47535747f">
 ]>
 
@@ -221,10 +221,17 @@
     <para>
       The <filename class="directory">/etc/ssl/local</filename> directory
-      is available to add additional CA certificates to the system. For
-      instance, you might need to add an organization or government CA
-      certificate. Files in this directory must be in the
-      <application>OpenSSL</application> trusted certificate format. To
-      create an <application>OpenSSL</application> trusted certificate from
-      a regular PEM encoded file, you need to add trust arguments to the
+      is available to add additional CA certificates to the system trust store.
+      This directory is also used to store certificates that were added to or
+      modified  in the system trust store by <xref linkend="p11-kit"/> so that
+      trust values are maintained across upgrades. Files in this directory must
+      be in the <application>OpenSSL</application> trusted certificate format.
+      Certificates imported using the <command>trust</command> utility from
+      <xref linkend="p11-kit"/> will utilize the x509 Extended Key Usage values
+      to assign default trust values for the system anchors.
+    </para>
+
+    <para>If you need to override trust values, or otherwise need to create
+      an <application>OpenSSL</application> trusted certificate manually
+      from a regular PEM encoded file, you need to add trust arguments to the
       <command>openssl</command> command, and create a new certificate. For
       example, using the <ulink url="http://www.cacert.org/">CAcert</ulink>
@@ -243,5 +250,5 @@
         -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
         > /etc/ssl/local/CAcert_Class_3_root.pem &amp;&amp;
-/usr/sbin/make-ca -r -f</userinput></screen>
+/usr/sbin/make-ca -r</userinput></screen>
 
     <bridgehead renderas="sect3">Overriding Mozilla Trust</bridgehead>
@@ -265,5 +272,5 @@
              -addreject codeSigning \
        > /etc/ssl/local/Disabled_Makebelieve_CA_Root.pem &amp;&amp;
-/usr/sbin/make-ca -r -f</userinput></screen>
+/usr/sbin/make-ca -r</userinput></screen>
 
   </sect2>
Index: postlfs/security/p11-kit.xml
===================================================================
--- postlfs/security/p11-kit.xml	(revision 673c07088ddf22a6010d2e5e60658c0437a62fbc)
+++ postlfs/security/p11-kit.xml	(revision 6133936264a5356a07eb8f2d081b5ae2c295788d)
@@ -104,6 +104,6 @@
 /usr/libexec/make-ca/copy-trust-modifications
 
-# Generate a new trust store
-/usr/sbin/make-ca -f -g</literal>
+# Update trust stores
+/usr/sbin/make-ca -r</literal>
 EOF</userinput></screen>
 
