Component: certificate
154 changelog entries across 58 version(s)
Releases by channel (stacked)
- fixed initial certificate creation using SCEP (introduced in v7.21);
- fixed empty trust store handling in certain cases (introduced in v7.21);
- added certificate "trust-store" parameter;
- added option to configure built-in trust store (replaced "builtin-trust-anchors" parameter);
- added SHA384, SHA512 support for SCEP;
- allow ca-crl-host parameter for issued certificates;
- fixed incorrect appearance of "invalid-before" and "invalid-after" dates;
- improved logging;
- on certificate import, added the "issued" flag if the certificate store contains the imported certificate's CA and its private key;
- refactored Certificate internal processes;
- added "Amazon Root CA 1" to built-in root certificate authorities store;
- fixed ACME certificate usage after renewal;
- improved stability after failed import;
- trust built-in root certificate authority store after configuration reset;
- added built-in root certificate authorities store;
- do not include CA identity in SCEP POST requests;
- fixed cloud-dns challenge validation for sn.mynetname.net (CLI only);
- improve error message when trying to use certificate;
- optimize trust store;
- fixed localized text conversion to UTF-8 on certificate creation;
- do not download CRL if there is not enough free RAM;
- do not show not relevant values for certificate template (CLI only);
- fixed handling of capsman-cap certificates (introduced in v7.16);
- removed unstructured address field support;
- do not download CRL if there is not enough free RAM;
- fixed handling of capsman-cap certificates (introduced in v7.16);
- added no-key-export parameter for import;
- added support for cloud-dns challenge validation for sn.mynetname.net (CLI only);
- automatically parse uppercase symbols to lowercase when registering domain on Let's Encrypt;
- improved DNS challenge error reporting for Let's Encrypt;
- improved RSA key signature processing speed;
- show validity beyond year 2038;
- added support for different ACME servers for ssl-certificate (CLI only);
- added support for importing pbes2 encrypted private keys with aes128;
- added trusted parameter for certificate import;
- allow replacing certificate with internal import;
- delete certificate related files automatically from storage after import;
- improved RSA key signature processing speed;
- improved certificate validation performance;
- add support for multiple DNS names for Let's Encrypt;
- added HTTP redirect support for CRL download;
- added support for certificates with key size 16384;
- fixed CRL updating;
- fixed certificate auto renewal via SCEP when certificate contains "subject-alt-name";
- improved CRL signature verification and download error messages;
- improved initial certificate creation using SCEP;
- use error topic for CRL update failures;
- allow to get and maintain Let's Encrypt certificate in IPv6 environment;
- allow to remove issued certificates when CRL is not used;
- fixed "subject-alt-name" duplicating itself when SCEP is used;
- fixed certificate auto renewal via SCEP;
- improved certificate validation logging error messages;
- log CRL HTTP errors under the "error" logging topic;
- allow to import certificate with DNS name constraint;
- fixed PEM import;
- fixed trust store CRL link if generated on an older version (introduced in v7.7);
- improved CRL download retry handling;
- removed request for "passphrase" property on import;
- require CRL presence when using "crl-use=yes" setting;
- restored RSA with SHA512 support;
- fixed displaying of certificate serial number;
- improved error reporting for Let's Encrypt certificate;
- restore available "key-usage" property options;
- fixed bogus log messages;
- fixed export of a certificate when the last line of the certificate is exactly 64 bytes long;
- fixed PBES2 certificate import;
- improved certificate management, signing and storing processes;
- improved multiple certificate import process;
- improved Let's Encrypt logging and error recovery;
- improved certificate management, signing and storing processes;
- fixed SHA1 certificate name lookup;
- improved certificate management, signing and storing processes;
- restricted maximum retry attempt window for Let's Encrypt certificate to 60 minutes;
- fixed handling of empty AKID by SCEP client;
- fixed new CRL updating;
- allow to choose digest algorithm for CSR signing;
- made "fingerprint" parameter read-only;
- improved stability when sending bogus SCEP message;
- improved stability when sending bogus SCEP message;