rcgen

Previous versions generated DER that is strictly incompatible with the spec, writing an explicit false value for IsCa::ExplicitNoCa where this should be omitted (as it's the default).

What's Changed

• doc: amend description to point to CertificateParams for additional explanation by @mcr in #433
• Omit default cA flag value as required by spec by @djc in #444

What's Changed

• Fix incorrect identifier for ML-DSA signature algorithms by @DarkmatterVale in #412
• Upgrade yasna to 0.6 by @djc in #419
• Add support for is_ca in CSR Params by @5Dev24 in #420
• Add support for serializing BasicConstraints in CSR's by @5Dev24 in #422
• update key_pair to signing_key in README.md by @fakelozic in #427
• Fix encoding of directoryName constraints by @sfackler in #429

What's Changed

• Implement From<KeyPair> for PrivateKeyDer<'static> by @LebedevRI in #403
• update copyright year in LICENSE by @jasmyhigh in #407
• Add P521-SHA256 and P521-SHA384 signing algorithms by @djc in #408

What's Changed

• Use private cfg for docs.rs-like builds by @ctz in #384
• Expand rustdoc for CertificateSigningRequestParams::from_der by @dwhjames in #386
• Group imports by @iamjpotts in #381
• examples: add signing new cert using existing ca pem files by @iamjpotts in #379
• Tweak CSR parsing errors/documentation by @djc in #390
• Rename invalid CSR signature error variant by @djc in #393
• chore: fix some typos in comments by @black5box in #395
• ci: sync cargo-check-external-types nightly by @cpu in #399
• Forward selected crypto backend to x509-parser by @djc in #398

Implement SigningKey for &impl SigningKey to make Issuer more broadly useful.

What's Changed

• Forward signing and public key data through references by @djc in #380

What's Changed

• Upgrade botan to 0.12 by @djc in #377
• Upgrade x509-parser to 0.18 by @djc in #376
• Add unstable support for ML-DSA algorithms by @djc in #374

What's Changed

• docs: fix typo in PKCS_RSA_SHA384 doc comment by @Bravo555 in #367
• Fix regression in key usage purpose encoding by @djc in #369

• Add a CertifiedIssuer type (see #363)

What's changed

• Add a CertifiedIssuer by @djc in #363
• Provide a non-owning constructor for Issuer by @p-avital in #362
• Allow access to the CertifiedIssuer's Certificate by @djc in #364

Declare 1.71 rust-version and check MSRV in CI.

What's Changed

• Check MSRV in CI by @djc in #361

0.14.0 contains a number of potentially breaking API changes, though hopefully the rate of API change should slow down after this. Here is a summary of the most noticeable changes you might run into:

• signed_by() methods now take a reference to an &Issuer type that contains both the issuer's relevant certificate parameters and the signing key (see #356). The from_ca_cert_der() and from_ca_cert_pem() constructors that were previously attached to CertificateParams are now attached to Issuer instead, removing a number of documented caveats.
• The RemoteKeyPair trait is now called SigningKey and instead of KeyPair being an enum that contains a Remote variant, that variant has been removed in favor of KeyPair implementing the trait (see #328). To align with this change, the CertifiedKey::key_pair field is now called signing_key, and CertifiedKey is generic over the signing key type.
• The KeyPair::public_key_der() method has moved to PublicKeyData::subject_public_key_info() (see #328).
• Output types like Certificate no longer contain their originating CertificateParams. Instead, signed_by() and self_signed() now take &self, allowing the caller to retain access to the input parameters (see #328). In order to make this possible, Certificate::key_identifier() can now be accessed via CertificateParams directly.
• String types have been moved into a module (see #329).

What's Changed

• Revert impl AsRef issuer by @audunhalland in #325
• Move string types to separate module by @est31 in #329
• Unbundle params from output types by @djc in #328
• Deduplicate Issuer construction by @djc in #332
• Extract write_extensions() method, reducing rightward drift by @djc in #333
• Update 0.12-to-0.13.md by @Alirexaa in #338
• Distribute methods for parsing params elements from x509 by @djc in #336
• Eagerly derive Clone, Copy, where possible by @lvkv in #341
• Updated .gitignore to be more specific by @Rynibami in #342
• Eagerly implemented Debug trait by @Rynibami in #343
• Minor tweaks to Debug impls and other style improvements by @djc in #348
• tests: only test against openssl on Unix by @djc in #350
• Eagerly implemented PartialEq and Eq traits by @Rynibami in #344
• Use Issuer directly in the public API by @djc in #356
• Tweak docstring for PublicKeyData::subject_public_key_info() by @djc in #358

Fixed:

• Fixed incorrect usage of the subject certificate's parameter's key identifier method when computing the key identifier of the issuer for the subject's authority key identifier (AKI) extension.

Breaking changes:

• The API used to create/issue key pairs, certificates, certificate signing requests (CSRs), and certificate revocation lists (CRLs) has been restructured to emphasize consistency and avoid common errors with serialization.

  For each concrete type (cert, CSR, CRL) the process is now the same:

  1. generate or load a key pair and any information about issuers required.
  2. create parameters, customizing as appropriate.
  3. call a generation fn on the parameters, providing subject key pair and issuer information and as appropriate.
  4. call serialization fns on the finalized type, obtaining DER or PEM.

  For more information, see [rcgen/docs/0.12-to-0.13.md].

• Throughout the API DER inputs are now represented using types from the Rustls rustls-pki-types crate, e.g. PrivateKeyDer, CertificateDer, CertificateSigningRequestDer. Contributed by Tudyx.

• String types used in SanType and DnValue enums for non-UTF8 string types have been replaced with more specific types that prevent representation of illegal values. E.g. Ia5String, BmpString, PrintableString, TeletexString, and UniversalString. Contributed by Tudyx.

• Method names starting with get_ have been renamed to match Rust convention: CertificateRevocationList::get_params() -> params() Certificate::get_params() -> params() Certificate::get_key_identifier() -> Certificate::key_identifier() Certificate::get_times() -> Certificate::times()

Added:

• RSA key generation support has been added. This support requires using the aws-lc-rs feature. By default using KeyPair::generate_for() with an RSA SignatureAlgorithm will generate an RSA 2048 keypair. See KeyPair::generate_rsa_for() for support for RSA 2048, 3072 and 4096 key sizes.

• Support for ECDSA P521 signatures and key generation has been added when using the aws-lc-rs feature. Contributed by Alvenix.

• Support for loading private keys that may be PKCS8, PKCS1, or SEC1 has been added when using the aws-lc-rs feature. Without this feature private keys must be PKCS8. See KeyPair::from_pem_and_sign_algo() and KeyPair::from_der_and_sign_algo() for more information. Contributed by Alvenix.

• Support has been added for Subject Alternative Name (SAN) names of type OtherName. Contributed by Tudyx.

• Support has been added for specifying custom "other" OIDs in extended key usage. Contributed by Tudyx.

• Support has been added for building rcgen without cryptography by omitting the new (default-enabled) crypto feature flag. Contributed by corrideat.

• Support for using aws-lc-rs in fips mode can now be activated by using the fips feature in combination with the aws-lc-rs feature. Contributed by BiagioFesta.

• A small command-line tool for certificate generation (rustls-cert-gen) was added. Contributed by tbro.

• RFC 5280 specifies that a serial number must not be larger than 20 octets in length. Prior to this release an unintended interaction between rcgen and its underlying DER encoding library could result in 21 octet serials. This has now been fixed.
• A regression that caused build errors when the optional pem feature was omitted has been fixed.

• Rename RcgenError to Error. Contributed by thomaseizinger.
• The public interface of Error has been made not expose external library types: Error::PemError now holds a String value, and the Error type doesn't support From<_> based conversion any more. This allows rcgen to update dependencies without impacting downstream users.
• Upgrade to ring v0.17. Contributed by thomaseizinger.
• Make dependency on ring optional and allow usage of aws-lc-rs via a cargo feature. Ring remains the default. Contributed by BiagioFesta.
• Add Ia5String support for DistinguishedNames.
• Add a KeyIdMethod::PreSpecified variant to set, and not generate the SKI. CertificateParams::from_ca_cert_pem now uses it when building params from an existing CA certificate. Contributed by Brocar.

• Fix for import errors building without the optional pem feature.

• rcgen has joined the umbrella of the rustls organization.
• Support for retrieving signature algorithm from KeyPairs. Contributed by tindzk.
• Fix for writing certificate signing requests (CSRs) with custom extensions from parameters without subject alternative names.
• Support for certificate CRL distribution points extension.
• Corrected OID for ExtendedKeyUsagePurpose::Any. Contributed by jgallagher.
• Support for creating certificate revocation lists (CRLs).

• Make botan a dev-dependency again. Contributed by mbrubeck.

• Parse IP-address subject alternative names. Contributed by iamjpotts.
• Emit platform-apropriate line endings. Contributed by frjonsen.
• Support larger serial numbers. Contributed by andrenth.
• Parse more certificate parameters. Contributed by andrenth.
• Output SanType::IpAddress when calling CertificateParams::new or generate_simple_self_signed. Contributed by rukai.
• Update pem to 2.0. Contributed by koushiro.

• Update x509-parser to 0.14.
• Increase minimum supported Rust version to 1.58.1.
• Update edition to 2021.
• Change IsCa enum to have NoCa and ExplicitNoCa and Ca(...). Contributed by doraneko94.

• yanked due to breaking API changes, see 0.10.0 instead.

• Add a KeyPair::serialized_der function. Contributed by jean-airoldie.

• Update x509-parser to 0.13. Contributed by matze.

• Change edition to 2018 in order to support Rust 1.53.0.

• Add RemoteKeyError for usage by remote keys.
• Support non utf8 strings. Contributed by omjadas.
• Switch from chrono to time. Contributed by connec.
• Update edition to 2021.

• Update pem to 1.0.
• Update x509-parser to 0.12.

• Bugfix release to make Certificate Send and Sync again.

• Use public key as default serial number. Contributed by jpastuszek.
• Add support for PKCS_RSA_SHA512 and PKCS_RSA_SHA384 signature algorithms.
• Add support for the keyUsage extension. Contributed by jaredwolff.
• Ability to use remote keys. Contributed by daxpedda.

• Add getters for the criticality, content, and oid_components of a CustomExtension
• Update yasna to 0.4

• Implement some additional traits for some of the types. Contributed by zurborg.
• Adoption of intra-doc-links
• Addition of the ability to zero key pairs. Contributed by didier-wenzek.

• Switch CI to Github Actions.
• Strip nanos from DateTime as well. Contributed by @trevor-crypto.

• Turn botan back into a dev-dependency. Contributed by @nthuemmel.
• Fix signing when CA uses different signing algorithm . Contributed by @nthuemmel.

• Add KeyPair::from_der
• Add botan based test to the testsuite
• Update x509-parser to 0.9. Contributed by @djc.
• Ability to create certificates from CSRs. Contributed by @djc.

• Add some more DnTypes: OrganizationalUnitName, LocalityName, StateOrProvinceName
• Add remove function to DistinguishedName
• Add ability to specify NameConstraints

• Improve spec compliance in the notBefore/notAfter fields generated by using UTCTime if needed

• Fix regression of 0.8.1 that generated standards non compliant CSRs and broke Go toolchain parsers. Contributed by @thomastaylor312.

• Disable chrono default features to get rid of time crate
• Improve openssl tests to do a full handshake with the generated cert

• Fix non-standard-compliant SubjectKeyIdentifier X.509v3 extension format
• BasicConstraints X.509v3 extension is now marked as critical
• Use RFC 7093 to calculate calculate subject key identifiers
• Add option to insert AuthorityKeyIdentifier X.509v3 extension into non-self-signed certificates
• Update to x509-parser 0.7

• Update to pem 0.7
• Correct number of nanoseconds per second. Contributed by @samlich.
• Adoption of the non_exhaustive feature in the API

• Bugfix release for ip address subject alternative names. Turns out they aren't CIDR subnets after all :)

• Support for email and cidr subnet (ip address) subject alternative names
• Support for the extended key usage extension

• Update to x509-parser 0.6

• Update to ring 0.16 and webpki 0.21
• Update to x509-parser 0.5
• Expose an API to get the raw public key of a key pair

• Allow inspection of DistinguishedName via iterators and get functions
• Fix a bug in is_compatible not saying false. Contributed by @fzgregor.
• Extend the public interface of KeyPair. Contributed by @fzgregor.

• Support for user supplied keypairs. Contributed by @fzgregor.
• Support for signing with user supplied CA certificates. Contributed by @fzgregor.
• Correct a bug with distinguished name serialization (PR link). Contributed by @fzgregor.
• Addition of limited (no key generation) RSA support
• Proper error handling with Result and our own Error type
• Improvements of the testsuite

• Ability to disable the dependency on the pem crate
• Support for creating CSRs (Certificate Signing Requests). Contributed by @djc.
• Ability to specify custom extensions for certificates
• Ability to craft acmeIdentifier extensions
• Update yasna to 0.3.0

• Support for CA certificate generation. Contributed by @djc.
• Support for certificate signing. Contributed by @djc.
• Support for ED25519 certificates
• Support for SHA-384 certificates
• API cleanups (Future proofing CertificateParams, public constant renames)

• Updated to pem 0.6