# This file is under puppet control
# Only the CAs for debian.org are trusted, see /etc/ssl/ca-debian/README
-mozilla/AddTrust_External_Root.crt
+
+# Let's Encrypt: used by almost all Debian machines
+mozilla/ISRG_Root_X1.crt
+
+# Gandi: used by *.alioth.d.o only
mozilla/UTN_USERFirst_Hardware_Root_CA.crt
-mozilla/DST_Root_CA_X3.crt