You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

289 lines
11 KiB

5 years ago
2 years ago
2 years ago
2 years ago
3 years ago
3 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
5 years ago
5 years ago
5 years ago
6 years ago
6 years ago
6 years ago
6 years ago
6 years ago
  1. [//]: # (Copyright 2019-2020 Rodolphe Bréard <rodolphe@breard.tf>)
  2. [//]: # (Copying and distribution of this file, with or without modification,)
  3. [//]: # (are permitted in any medium without royalty provided the copyright)
  4. [//]: # (notice and this notice are preserved. This file is offered as-is,)
  5. [//]: # (without any warranty.)
  6. # Changelog
  7. All notable changes to this project will be documented in this file.
  8. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
  9. and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
  10. ## [Unreleased]
  11. ### Fixed
  12. - ACMEd no longer crashes when the `random_early_renew` parameter is set to zero (GitHub bug #102).
  13. ### Changed
  14. - The minimum supported Rust version (MSRV) is now 1.70.
  15. - Manual (and badly designed) threads have been replaced by async.
  16. - Randomized early delay, for spacing out renewals when dealing with a lot of certificates.
  17. - Replaced the template engine TinyTemplate with MiniJinja.
  18. - The default period of time between the certificate renewal and its expiration date (`renew_delay`) has been changed from 3 weeks to 30 days.
  19. ## [0.21.0] - 2022-12-19
  20. ### Fixed
  21. - The JWK representation of ECDSA keys now have their coordinates padded.
  22. ### Changed
  23. - The minimal required Rust version is now 1.60.
  24. ## [0.20.0] - 2022-05-08
  25. ### Added
  26. - The `--no-pid-file` argument has been added to ACMEd and tacd.
  27. ### Fixed
  28. - An invalid reference in the command line arguments has been fixed.
  29. - Some missing file path in log messages has been added.
  30. - The calculation of the certificate's expiration delay does no longer break compilation on some systems.
  31. ## [0.19.0] - 2022-04-17
  32. ### Added
  33. - The `acmed@user.service` systemd unit configuration has been added as an alternative to the `acmed.service` unit.
  34. ### Changed
  35. - The minimal required Rust version is now 1.54.
  36. ## [0.18.0] - 2021-06-13
  37. ### Added
  38. - Add support for Ed25519 and Ed448 account keys and certificates.
  39. - In addition to `restart`, the Polkit rule also allows the `reload`, `try-restart`, `reload-or-restart` and `try-reload-or-restart` verbs.
  40. ## [0.17.0] - 2021-05-04
  41. ### Added
  42. - Allow the configuration of some default values at compile time using environment variables.
  43. ### Changed
  44. - The template engine has been changed in favor of TinyTemplate, which has a different syntax than the previous one.
  45. - The default account directory now is `/var/lib/acmed/accounts`.
  46. - The default certificates and private keys directory now is `/var/lib/acmed/certs`.
  47. - The default for volatile runtime data now is `/run`.
  48. ## [0.16.0] - 2020-11-11
  49. ### Added
  50. - The `pkcs9_email_address`, `postal_address` and `postal_code` subject attributes has been added.
  51. ### Changed
  52. - The `friendly_name` and `pseudonym` subject attributes has been removed.
  53. - The `street_address` subject attribute has been renamed `street`.
  54. ## [0.15.0] - 2020-11-03
  55. ### Added
  56. - The names of both the certificate file and the associated private key can now be configured.
  57. ### Fixed
  58. - Configuration files cannot be loaded more than one time, which prevents infinite recursion.
  59. ### Changed
  60. - Certificates are now allowed to share the same name if their respective key type is different.
  61. ## [0.14.0] - 2020-10-27
  62. ### Added
  63. - Add proxy support through the `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables.
  64. - Allow to specify a unique name for each certificate.
  65. ### Changed
  66. - The minimal required Rust version is 1.42.0.
  67. ## [0.13.0] - 2020-10-10
  68. ### Added
  69. - In the configuration, `root_certificates` has been added to the `global` and `endpoint` sections as an array of strings representing the path to root certificate files.
  70. - At compilation, it is now possible to statically link OpenSSL using the `openssl_vendored` feature.
  71. - In the Makefile, it is now possible to specify which target triple to build for.
  72. ## [0.12.0] - 2020-09-26
  73. ### Added
  74. - Some subject attributes can now be specified.
  75. - Support for NIST P-521 certificates and account keys.
  76. ### Fixed
  77. - Support for Let's Encrypt non-standard account creation object.
  78. ## [0.11.0] - 2020-09-19
  79. ### Added
  80. - The `contacts` account configuration field has been added.
  81. - External account binding.
  82. ### Changed
  83. - The `email` account configuration field has been removed. In replacement, use the `contacts` field.
  84. - Accounts now have their own hooks and environment.
  85. - Accounts are now stored in a single binary file.
  86. ### Fixed
  87. - ACMEd can now build on platforms with a `time_t` not defined as an `i64`.
  88. - The Makefile is now fully works on FreeBSD.
  89. ## [0.10.0] - 2020-08-27
  90. ### Added
  91. - The account key type and signature algorithm can now be specified in the configuration using the `key_type` and `signature_algorithm` parameters.
  92. - The delay to renew a certificate before its expiration date can be specified in the configuration using the `renew_delay` parameter at either the certificate, endpoint and global level.
  93. - It is now possible to specify IP identifiers (RFC 8738) using the `ip` parameter instead of the `dns` one.
  94. - The hook templates of type `challenge-*` have a new `identifier_tls_alpn` field which contains, if available, the identifier in a form that is suitable to the TLS ALPN challenge.
  95. - Globing is now supported for configuration files inclusion.
  96. - The CSR's digest algorithm can now be specified using the `csr_digest` parameter.
  97. ### Changed
  98. - In the certificate configuration, the `domains` field has been renamed `identifiers`.
  99. - The `algorithm` certificate configuration field has been renamed `key_type`.
  100. - The `algorithm` hook template variable has been renamed `key_type`.
  101. - The `domain` hook template variable has been renamed `identifier`.
  102. - The default hooks have been updated.
  103. ### Fixed
  104. - The Makefile now works on FreeBSD. It should also work on other BSD although it has not been tested.
  105. ## [0.9.0] - 2020-08-01
  106. ### Added
  107. - System users and groups can now be specified by name in addition to uid/gid.
  108. ### Changed
  109. - The HTTP(S) part is now handled by `attohttpc` instead of `reqwest`.
  110. ### Fixed
  111. - In tacd, the `--acme-ext-file` parameter is now in conflict with `acme-ext` instead of itself.
  112. ## [0.8.0] - 2020-06-12
  113. ### Changed
  114. - The HTTP(S) part is now handled by `reqwest` instead of `http_req`.
  115. ## Fixed
  116. - `make install` now work with the busybox toolchain.
  117. ## [0.7.0] - 2020-03-12
  118. ### Added
  119. - Wildcard certificates are now supported. In the file name, the `*` is replaced by `_`.
  120. - Internationalized domain names are now supported.
  121. ### Changed
  122. - The PID file is now always written whether or not ACMEd is running in the foreground. Previously, it was written only when running in the background.
  123. ### Fixed
  124. - In the directory, the `externalAccountRequired` field is now a boolean instead of a string.
  125. ## [0.6.1] - 2019-09-13
  126. ### Fixed
  127. - A race condition when requesting multiple certificates on the same non-existent account has been fixed.
  128. - The `foregroung` option has been renamed `foreground`.
  129. ## [0.6.0] - 2019-06-05
  130. ### Added
  131. - Hooks now have the optional `allow_failure` field.
  132. - In hooks, the `stdin_str` has been added in replacement of the previous `stdin` behavior.
  133. - HTTPS request rate limits.
  134. ### Changed
  135. - Certificates are renewed in parallel.
  136. - Hooks are now cleaned right after the current challenge has been validated instead of after the certificate's retrieval.
  137. - In hooks, the `stdin` field now refers to the path of the file that should be written into the hook's standard input.
  138. - The logging format has been re-written.
  139. ### Fixed
  140. - The http-01-echo hook now correctly sets the file's access rights
  141. ## [0.5.0] - 2019-05-09
  142. ### Added
  143. - ACMEd now displays a warning when the server indicates an error in an order or an authorization.
  144. - A configuration file can now include several other files.
  145. - Hooks have access to environment variables.
  146. - In the configuration, the global section, certificates and domains can define environment variables for the hooks.
  147. - tacd is now able to listen on a unix socket.
  148. ## [0.4.0] - 2019-05-08
  149. ### Added
  150. - Man pages.
  151. - The project can now be built and installed using `make`.
  152. - The post-operation hooks now have access to the `is_success` template variable.
  153. - Challenge hooks now have the `is_clean_hook` template variable.
  154. - An existing certificate will be renewed if more domains have been added in the configuration.
  155. ### Changed
  156. - Unknown configuration fields are no longer tolerated.
  157. ### Removed
  158. - In challenge hooks, the `algorithm` template variable has been removed.
  159. ### Fixed
  160. - In some cases, ACMEd was unable to parse a certificate's expiration date.
  161. ## [0.3.0] - 2019-04-30
  162. ### Added
  163. - tacd, the TLS-ALPN-01 validation daemon.
  164. - An account object has been added in the configuration.
  165. - In the configuration, hooks now have a mandatory `type` variable.
  166. - It is now possible to declare hooks to clean after the challenge validation hooks.
  167. - The CLI `--root-cert` option has been added.
  168. - Failure recovery: HTTPS requests rejected by the server that are recoverable, like the badNonce error, are now retried several times before being considered a hard failure.
  169. - The TLS-ALPN-01 challenge is now supported. The proof is a string representation of the acmeIdentifier extension. The self-signed certificate itself has to be built by a hook.
  170. ### Changed
  171. - In the configuration, the `email` certificate field has been replaced by the `account` field which matches an account object.
  172. - The format of the `domain` configuration variable has changed and now includes the challenge type.
  173. - The `token` challenge hook variable has been renamed `file_name`.
  174. - The `challenge_hooks`, `post_operation_hooks`, `file_pre_create_hooks`, `file_post_create_hooks`, `file_pre_edit_hooks` and `file_post_edit_hooks` certificate variables has been replaced by `hooks`.
  175. - The logs has been purged from many useless debug and trace entries.
  176. ### Removed
  177. - The DER storage format has been removed.
  178. - The `challenge` certificate variables has been removed.
  179. ## [0.2.1] - 2019-03-30
  180. ### Changed
  181. - The bug that prevented from requesting more than two certificates has been fixed.
  182. ## [0.2.0] - 2019-03-27
  183. ### Added
  184. - The `kp_reuse` flag allow to reuse a key pair instead of creating a new one at each renewal.
  185. - It is now possible to define hook groups that can reference either hooks or other hook groups.
  186. - Hooks can be defined when before and after a file is created or edited (`file_pre_create_hooks`, `file_post_create_hooks`, `file_pre_edit_hooks` and `file_post_edit_hooks`).
  187. - It is now possible to send logs either to syslog or stderr using the `--to-syslog` and `--to-stderr` arguments.
  188. ### Changed
  189. - `post_operation_hook` has been renamed `post_operation_hooks`.
  190. - By default, logs are now sent to syslog instead of stderr.
  191. - The process is now daemonized by default. It is possible to still run it in the foreground using the `--foregroung` flag.