x509-cert

Added

• Serial number generator (#1270)
• DecodeValue for x509_cert::time::Time (#1986)
• FromStr for x509_cert::time::Time (#1961)
• impl Hash for Name (#1764)
• impl Ord for CrlReason (#1869)
• DirectoryString::BmpString (#1794)
• Crl builder (#1759)
• Time::now method (#1761)
• Validity::infinity helper (#1528)
• Validity::new method (#1529)
• Re-export spki types without *Owned suffixes (#1534)
• x509_cert::builder::AsyncBuilder using AsyncSigner (#1280)

Changed

• Decompose AsExtension into Criticality + AsExtension (#2109)
• Improve extension API flexibility and ergonomics (#2120)
• Expose Profile in the CrlBuilder (#1870)
• Ensure a serial number can be stored in a database (#1868)
• Move the CSR builder x509_cert::request (#1581)
• Rename x509_cert::builder::Profile to BuilderProfile (#1514, #1517)
• Name is now a new type over RdnSequence (#1499)
• make RelativeDistinguishedName fields private (#1510)
• make RdnSequence fields private (#1508)
• make (Tbs)CertificateInner fields private (#1505)
• rename helpers to get_extension/filter_extensions (#1497)
• check_name_encoding now allow extraneous components (#1447)
• Accept RFC-invalid certificates as TrustAnchors (#1403)
• Edition changed to 2024 and MSRV bumped to 1.85 (#1689)
• Bump rand to v0.10 (#2212)
• Bump der to v0.8 (#2234)
• Bump digest to v0.11 (#2237)
• Bump sha2 to v0.11 (#2273)
• Bump spki to v0.8 (#2277)
• Bump signature to v3 (#2326)

Fixed

• Converting from SystemTime should use UtcTime if date <= 2049 (#1969)
• Underflow on empty input in Certificate::load_pem_chain (#1965)
• Domain validated should accept CNs (#1815)
• Serialization of email addresses (#1425)

Removed

• std requirement for x509_cert::builder (#1709)
• RelativeDistinguishedName::encode_from_string (#1509)

Co-authored-by: Tony Arcieri [email protected]

Added

• Serial number generator (#1270)
• DecodeValue for x509_cert::time::Time (#1986)
• FromStr for x509_cert::time::Time (#1961)
• impl Hash for Name (#1764)
• impl Ord for CrlReason (#1869)
• DirectoryString::BmpString (#1794)
• Crl builder (#1759)
• Time::now method (#1761)
• Validity::infinity helper (#1528)
• Validity::new method (#1529)
• Re-export spki types without *Owned suffixes (#1534)
• x509_cert::builder::AsyncBuilder using AsyncSigner (#1280)

Changed

• Decompose AsExtension into Criticality + AsExtension (#2109)

• Improve extension API flexibility and ergonomics (#2120)

• Expose Profile in the CrlBuilder (#1870)

• Ensure a serial number can be stored in a database (#1868)

• Move the CSR builder x509_cert::request (#1581)

• Rename x509_cert::builder::Profile to BuilderProfile (#1514 && #1517)

• Name is now a new type over RdnSequence (#1499)

• make RelativeDistinguishedName fields private (#1510)

• make RdnSequence fields private (#1508)

• make (Tbs)CertificateInner fields private (#1505)

• rename helpers to get_extension/filter_extensions (#1497)

• check_name_encoding now allow extraneous components (#1447)

• Accept RFC-invalid certificates as TrustAnchors (#1403)

• Edition changed to 2024 and MSRV bumped to 1.85 (#1689)

• Bump rand to v0.10 (#2212)

• Bump der to v0.8 (#2234)

• Bump digest to v0.11 (#2237)

• Bump sha2 to v0.11 (#2273)

• Bump spki to v0.8 (#2277)

• Bump signature to v3 (#2326)

Fixed

• Converting from SystemTime should use UtcTime if date <= 2049 (#1969)
• Underflow on empty input in Certificate::load_pem_chain (#1965)
• Domain validated should accept CNs (#1815)
• Serialization of email addresses (#1425)

Removed

• Std requirement for x509_cert::builder (#1709)
• RelativeDistinguishedName::encode_from_string (#1509)

Added

• Signed Certificate Timestamp (SCT) extension support (#1134)

Changed

• Relax dependencies (#1179)
• Use SubjectPublicKeyInfoOwned::from_key (#1271)

Added

• add_attribute to RequestBuilder (#1137)

Changed

• bump serde_json from 1.0.97 to 1.0.99 (#1122)
• use the shortest name when looking attr OID (#1130)
• bump serde_json from 1.0.100 to 1.0.103 (#1158)

Fixed

• RDN string representation (#1126)
• Arbitrary for certificates (#1150)

Added

• Added TryFrom for RelativeDistinguishedName (#1092)
• Load a chain of certificates from a slice (#1081)

Added

• Certificate builder (#764)
• Support for RandomizedSigner in builder (#1007)
• Provide parsing profiles (#987)
• Support for Time::INFINITY (#1024)
• Conversion from std::net::IpAddr (#1035)
• CertReq builder (#1034)
• missing extension implementations (#1050)
• notes about UTCTime range being 1970-2049 (#1052)
• consume the SignatureBitStringEncoding trait (#1048)

Changed

• use ErrorKind::Value for overlength serial (#988)
• Bump hex-literal to v0.4.1 (#999)
• Builder updates (#1001)
• better debug info when zlint isn't installed (#1018)
• make SKI optional in leaf certificate (#1028)
• bump rsa from 0.9.0-pre.2 to 0.9.0 (#1033)
• bump rsa from 0.9.1 to 0.9.2 (#1056)

Fixed

• fix KeyUsage bit tests (#993)
• extraneous PhantomData in TbsCertificate (#1017)
• CI flakiness (#1042)
• usage of ecdsa signer (#1043)

Added

• FromStr impls for RdnSequence (Name), RelativeDistinguishedName, and AttributeTypeAndValue (#949)

Changed

• Deprecate encode_from_string functions (#951)

Added

• Feature-gated Arbitrary impl for Certificate (#761)
• Allow request to be serialized to PEM (#819)
• Display impl for SerialNumber (#820)
• std feature implies const-oid/std (#874)

Changed

• Serial numbers are formatted as PrintableString (#794)
• SerialNumber is now a specialized object (#795)
• MSRV 1.65 (#805)
• Make types owned instead of reference-based (#806, #841)
• Bump der to v0.7 (#899)
• Bump spki to v0.7 (#900)

Fixed

• Handling of negative serial numbers (#823, #831)

Removed

• alloc feature: now unconditionally required (#841)

Added

• Support TeletexString in DirectoryString (#692)
• Re-export spki (#701)
• PemLabel impl for Certificate (#763)
• ValueOrd impl for Version and other derived types (#723)

Fixed

• countryName should always be PrintableString (#760)

• Initial release