starred/certforge
1
0
Fork 0
mirror of https://github.com/rkivalin/certforge.git synced 2026-10-15 08:00:47 +00:00
Code Issues Packages Projects Releases Wiki Activity
21 Commits 1 Branch 10 Tags
v0.5.0
Commit Graph
11 Commits
Author SHA1 Message Date
Roman KivalinandClaude Opus 4.6 f63af47487 Fix wildcard DNS-01 challenges 
Per RFC 8555 §8.4, the DNS-01 challenge for *.example.com uses
_acme-challenge.example.com (strip the *. prefix), not the invalid
_acme-challenge.*.example.com.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 23:40:39 +02:00
Roman KivalinandClaude Opus 4.6 96f98352a8 Don't bind systemd-creds to a specific credential name 
Omit --name= from systemd-creds encrypt so the encrypted credential
can be loaded under any name via LoadCredentialEncrypted=. Previously,
the embedded name had to match the credential name in the service
unit, causing decryption failures when services used different names.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 23:29:26 +02:00
Roman KivalinandClaude Opus 4.6 3674a222a6 Bump version to 0.5.0 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 22:17:03 +02:00
Roman KivalinandClaude Opus 4.6 da8c937782 Refactor config: named DNS clients, challenge solvers, per-domain solver assignment 
Breaking config change. The DNS and challenge configuration is now
structured around named, reusable components:

- [dns.*] named DNS client connections with explicit zone field
- [solver.*] challenge solvers (dns-01, http-01, tls-alpn-01)
- Certificates reference solvers by name (solver/solvers fields)
- DANE blocks reference DNS clients by name (dns field)
- Removed automatic zone detection heuristics
- Added default_solver for global fallback
- Validation: DNS-01 rejected for IP addresses, solver/solvers
  mutual exclusivity, length matching, reference integrity

HTTP-01 and TLS-ALPN-01 solver implementations to follow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 19:15:01 +02:00
Roman KivalinandClaude Opus 4.6 40d7240ef9 Bump version to 0.4.0 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 23:54:40 +02:00
Roman KivalinandClaude Opus 4.6 af8cdd3e41 Add DNS propagation delay before ACME challenge validation 
Wait 5 seconds after publishing DNS-01 TXT records before notifying
the ACME server, giving the DNS server time to propagate the update.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 23:31:59 +02:00
Roman KivalinandClaude Opus 4.6 8ed22ca1d5 Bump version to 0.3.0 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 23:29:36 +02:00
Roman KivalinandClaude Opus 4.6 08cacff569 Build release binaries on Ubuntu 22.04 for glibc 2.35 compat 
Debian 12 (bookworm) ships glibc 2.36. The previous ubuntu-latest
(24.04) produced binaries requiring glibc 2.39.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 22:43:35 +02:00
Roman KivalinandClaude Opus 4.6 1c5aa8b930 Bump version to 0.2.0 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 21:52:07 +02:00
Roman KivalinandClaude Opus 4.6 000ec410b1 Add README and CHANGELOG 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 21:07:20 +02:00
Roman KivalinandClaude Opus 4.6 1c517ecbab Add packaging, CI, and license 
- MIT license
- Arch Linux PKGBUILD
- Debian packaging (debian/)
- GitHub Actions: CI (test + clippy) and release workflow
  builds x86_64 + aarch64 binaries, Arch and Debian packages
- Default config is now no-op (certificate blocks commented out)
- Fix clippy warnings (collapsible ifs, redundant closures)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 20:47:00 +02:00