Index: general.ent
===================================================================
--- general.ent	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ general.ent	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -1,5 +1,5 @@
 <!-- $LastChangedBy$ $Date$ -->
 
-<!ENTITY day          "05">                   <!-- Always 2 digits -->
+<!ENTITY day          "06">                   <!-- Always 2 digits -->
 <!ENTITY month        "09">                   <!-- Always 2 digits -->
 <!ENTITY year         "2018">
@@ -7,5 +7,5 @@
 <!ENTITY copyholder   "The BLFS Development Team">
 <!ENTITY version      "&year;-&month;-&day;">
-<!ENTITY releasedate  "September 5th, &year;">
+<!ENTITY releasedate  "September 6th, &year;">
 <!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
 <!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->
Index: general/prog/ojdk-conf.xml
===================================================================
--- general/prog/ojdk-conf.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ general/prog/ojdk-conf.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -89,5 +89,5 @@
       <envar>$JAVA_HOME</envar><filename>/lib/security/cacerts</filename> by
       default. In order to keep all the certificates in one place, we use
-      <filename>/etc/ssl/java/cacerts.jks</filename>. That file should be
+      <filename>/etc/ssl/java/cacerts</filename>. That file should be
       generated using the system PKI trust store. The instructions
       on the <xref linkend="make-ca"/> page should be used to update the file
@@ -98,5 +98,5 @@
 
 <screen role="root"><userinput>/usr/sbin/make-ca -g --force &amp;&amp;
-ln -sfv /etc/ssl/java/cacerts.jks /opt/jdk/lib/security/cacerts</userinput></screen>
+ln -sfv /etc/ssl/java/cacerts /opt/jdk/lib/security/cacerts</userinput></screen>
 
     <para>
Index: general/prog/openjdk.xml
===================================================================
--- general/prog/openjdk.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ general/prog/openjdk.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -241,5 +241,5 @@
                --with-version-pre=""        \
                --with-version-opt=""        \
-               --with-cacerts-file=/etc/ssl/java/cacerts.jks &amp;&amp;
+               --with-cacerts-file=/etc/ssl/java/cacerts &amp;&amp;
 make images</userinput></screen>
 
@@ -394,5 +394,5 @@
 
     <para>
-      <parameter>--with-cacerts-file=/etc/ssl/java/cacerts.jks</parameter>:
+      <parameter>--with-cacerts-file=/etc/ssl/java/cacerts</parameter>:
       Specifies where to find a <filename>cacerts</filename> file,
       <filename>/etc/ssl/java/</filename> on a BLFS system. Otherwise, an empty
@@ -444,14 +444,14 @@
 
       <para>
-        If you have run the instructions for <xref linkend="ojdk-certs"/>,
-        you only need to create a symlink in the default location for
-        those certificates. As user <systemitem
+        If you have run the instructions on the <xref linkend="make-ca"/> page,
+        you only need to create a symlink in the default location for the
+        <filename>cacerts</filename> file. As user <systemitem
         class="username">root</systemitem>:
       </para>
 
-<screen role="root"><userinput>ln -sfv /etc/ssl/java/cacerts.jks /opt/jdk/lib/security/cacerts</userinput></screen>
+<screen role="root"><userinput>ln -sfv /etc/ssl/java/cacerts /opt/jdk/lib/security/cacerts</userinput></screen>
 
       <para>
-        To check the installatiion, as when <xref linkend="ojdk-certs"/>, issue:
+        To check the installatiion, issue:
       </para>
 
Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ introduction/welcome/changelog.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -43,4 +43,14 @@
 -->
     <listitem>
+      <para>September 6th, 2018</para>
+      <itemizedlist>
+        <listitem>
+          <para>[dj] - Update to make-ca-0.9. Fixes
+          <ulink url="&blfs-ticket-root;11114">#11114</ulink>.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
+    <listitem>
       <para>September 5th, 2018</para>
       <itemizedlist>
Index: packages.ent
===================================================================
--- packages.ent	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ packages.ent	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -25,5 +25,5 @@
 <!ENTITY linux-pam-docs-version       "1.2.0">
 <!ENTITY libpwquality-version         "1.4.0">
-<!ENTITY make-ca-version              "0.8">
+<!ENTITY make-ca-version              "0.9">
 <!ENTITY mitkrb-major-version         "1.16">
 <!ENTITY mitkrb-version               "1.16.1">
Index: postlfs/security/make-ca.xml
===================================================================
--- postlfs/security/make-ca.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ postlfs/security/make-ca.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -8,9 +8,9 @@
   <!ENTITY certpath              "/lib/ckfw/builtins/certdata.txt">
   <!ENTITY make-ca-buildsize     "6.6 MB (with all runtime deps)">
-  <!ENTITY make-ca-time          "0.3 SBU (with all runtime deps)">
+  <!ENTITY make-ca-time          "0.1 SBU (with all runtime deps)">
 
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/archive/v&make-ca-version;/make-ca-&make-ca-version;.tar.gz">
   <!ENTITY make-ca-size          "36 KB">
-  <!ENTITY make-ca-md5sum        "1f0176c4fa89274971b2826a97f303f7">
+  <!ENTITY make-ca-md5sum        "0eeaf712eedeae4fa55d8bfa37f4ca32">
 ]>
 
@@ -75,14 +75,15 @@
 
     <bridgehead renderas="sect3">make-ca Dependencies</bridgehead>
-<!--
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required"><xref linkend="openssl"/></para>
--->
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended"><xref linkend="p11-kit"/> (required at runtime to
+    generate certificate stores from trust anchors)</para>
+
    <bridgehead renderas="sect4">Optional (runtime)</bridgehead>
     <para role="optional">
       <xref role="runtime" linkend="java"/> or
-      <xref role="runtime" linkend="openjdk"/>,
-      <xref role="runtime" linkend="nss"/>, and
-      <xref role="runtime" linkend="p11-kit"/>
+      <xref role="runtime" linkend="openjdk"/> (to generate a java PKCS#12
+      store), and <xref role="runtime" linkend="nss"/> (to generate a shared
+      NSSDB)
     </para>
 
@@ -96,8 +97,11 @@
     <para>The <application>make-ca</application> script will download and
     process the certificates included in the <filename>certdata.txt</filename>
-    file for use in multiple certificate stores (if the associated applications
-    are present on the system). Additionally, any local certificates stored in
-    <filename>/etc/ssl/local</filename> will be imported to the certificate
-    stores. Certificates in this directory should be stored as PEM encoded
+    file for use as trust anchors for the <xref linkend="p11-kit"/> trust
+    module. Additionally, it will generate system certificate stores used by
+    BLFS applications (if the recommended and optional applications are present
+    on the system). Any local certificates stored in
+    <filename>/etc/ssl/local</filename> will be imported to both the trust
+    anchors and the generated certificate stores (overriding Mozilla's trust).
+    Certificates in this directory should be stored as PEM encoded
     <application>OpenSSL</application> trusted certificates.</para>
 
@@ -141,11 +145,12 @@
 <screen role="root"><userinput>make install</userinput></screen>
 
-   <para>As the <systemitem class="username">root</systemitem> user, download
-   and update the certificate stores with the following command:</para>
+   <para>As the <systemitem class="username">root</systemitem> user, after
+   installing <xref linkend="p11-kit"/>, download the certificate source and
+   prepare for system use with the following command:</para>
 
     <note>
       <para>If running the script a second time with the same version of
       <filename>certdata.txt</filename>, for instance, to add additional stores
-      as the requisite software is installed, add the <parameter>-f</parameter>
+      as the requisite software is installed, add the <parameter>-r</parameter>
       switch to the command line. If packaging, run <command>make-ca
       --help</command> to see all available command line options.</para>
@@ -224,5 +229,5 @@
           <para>is a shell script that adapts a current version of
           <filename>certdata.txt</filename>, and prepares it for use
-          as the system certificate store.</para>
+          as the system trust store.</para>
           <indexterm zone="make-ca make-ca">
             <primary sortas="b-make-ca">make-ca</primary>
Index: postlfs/security/p11-kit.xml
===================================================================
--- postlfs/security/p11-kit.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ postlfs/security/p11-kit.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -75,5 +75,4 @@
     <bridgehead renderas="sect4">Recommended</bridgehead>
     <para role="recommended">
-      <xref linkend="make-ca"/> and
       <xref linkend="libtasn1"/>
     </para>
@@ -81,5 +80,6 @@
     <bridgehead renderas="sect4">Optional</bridgehead>
     <para role="optional">
-      <xref linkend="nss"/>,
+      <xref linkend="make-ca"/> (runtime), 
+      <xref linkend="nss"/> (runtime),
       <xref linkend="gtk-doc"/> and
       <xref linkend="libxslt"/>
