Index: postlfs/security/make-ca.xml
===================================================================
--- postlfs/security/make-ca.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ postlfs/security/make-ca.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -8,9 +8,9 @@
   <!ENTITY certpath              "/lib/ckfw/builtins/certdata.txt">
   <!ENTITY make-ca-buildsize     "6.6 MB (with all runtime deps)">
-  <!ENTITY make-ca-time          "0.3 SBU (with all runtime deps)">
+  <!ENTITY make-ca-time          "0.1 SBU (with all runtime deps)">
 
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/archive/v&make-ca-version;/make-ca-&make-ca-version;.tar.gz">
   <!ENTITY make-ca-size          "36 KB">
-  <!ENTITY make-ca-md5sum        "1f0176c4fa89274971b2826a97f303f7">
+  <!ENTITY make-ca-md5sum        "0eeaf712eedeae4fa55d8bfa37f4ca32">
 ]>
 
@@ -75,14 +75,15 @@
 
     <bridgehead renderas="sect3">make-ca Dependencies</bridgehead>
-<!--
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required"><xref linkend="openssl"/></para>
--->
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended"><xref linkend="p11-kit"/> (required at runtime to
+    generate certificate stores from trust anchors)</para>
+
    <bridgehead renderas="sect4">Optional (runtime)</bridgehead>
     <para role="optional">
       <xref role="runtime" linkend="java"/> or
-      <xref role="runtime" linkend="openjdk"/>,
-      <xref role="runtime" linkend="nss"/>, and
-      <xref role="runtime" linkend="p11-kit"/>
+      <xref role="runtime" linkend="openjdk"/> (to generate a java PKCS#12
+      store), and <xref role="runtime" linkend="nss"/> (to generate a shared
+      NSSDB)
     </para>
 
@@ -96,8 +97,11 @@
     <para>The <application>make-ca</application> script will download and
     process the certificates included in the <filename>certdata.txt</filename>
-    file for use in multiple certificate stores (if the associated applications
-    are present on the system). Additionally, any local certificates stored in
-    <filename>/etc/ssl/local</filename> will be imported to the certificate
-    stores. Certificates in this directory should be stored as PEM encoded
+    file for use as trust anchors for the <xref linkend="p11-kit"/> trust
+    module. Additionally, it will generate system certificate stores used by
+    BLFS applications (if the recommended and optional applications are present
+    on the system). Any local certificates stored in
+    <filename>/etc/ssl/local</filename> will be imported to both the trust
+    anchors and the generated certificate stores (overriding Mozilla's trust).
+    Certificates in this directory should be stored as PEM encoded
     <application>OpenSSL</application> trusted certificates.</para>
 
@@ -141,11 +145,12 @@
 <screen role="root"><userinput>make install</userinput></screen>
 
-   <para>As the <systemitem class="username">root</systemitem> user, download
-   and update the certificate stores with the following command:</para>
+   <para>As the <systemitem class="username">root</systemitem> user, after
+   installing <xref linkend="p11-kit"/>, download the certificate source and
+   prepare for system use with the following command:</para>
 
     <note>
       <para>If running the script a second time with the same version of
       <filename>certdata.txt</filename>, for instance, to add additional stores
-      as the requisite software is installed, add the <parameter>-f</parameter>
+      as the requisite software is installed, add the <parameter>-r</parameter>
       switch to the command line. If packaging, run <command>make-ca
       --help</command> to see all available command line options.</para>
@@ -224,5 +229,5 @@
           <para>is a shell script that adapts a current version of
           <filename>certdata.txt</filename>, and prepares it for use
-          as the system certificate store.</para>
+          as the system trust store.</para>
           <indexterm zone="make-ca make-ca">
             <primary sortas="b-make-ca">make-ca</primary>
Index: postlfs/security/p11-kit.xml
===================================================================
--- postlfs/security/p11-kit.xml	(revision 4d7d99dcc8704bf7b5fa7105407dcba9b5277da3)
+++ postlfs/security/p11-kit.xml	(revision c1cd435ef6d22fe60f71939440ef4b39309273dc)
@@ -75,5 +75,4 @@
     <bridgehead renderas="sect4">Recommended</bridgehead>
     <para role="recommended">
-      <xref linkend="make-ca"/> and
       <xref linkend="libtasn1"/>
     </para>
@@ -81,5 +80,6 @@
     <bridgehead renderas="sect4">Optional</bridgehead>
     <para role="optional">
-      <xref linkend="nss"/>,
+      <xref linkend="make-ca"/> (runtime), 
+      <xref linkend="nss"/> (runtime),
       <xref linkend="gtk-doc"/> and
       <xref linkend="libxslt"/>
