v2.10.1

What's Changed

• Upgrade golangci-lint to v2.9.0 for Go 1.26 by @mcpherrinm in #538
• Optional comments from #536 by @beautifulentropy in #541
• Fix in.Rcode type for fmt.Errorf() by @paulwouters in #542
• Replace docker/login-action with inline docker login by @inahga in #543
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #545
• Add accounturi to dns-persist-01 challenges by @felixfontein in #544

New Contributors

• @paulwouters made their first contribution in #542
• @inahga made their first contribution in #543

Full Changelog: v2.10.0...v2.10.1

v2.10.0

What's Changed

• Require User-Agent header for all requests by @aarongable in #530
• Reply with alreadyReplaced problem when certificate has already been replaced by @oliverpool in #532
• Prepare pebble-challtestsrv for DNS-persist challenge support by @beautifulentropy in #535
• Fix go-lint-checks CI job failures by @beautifulentropy in #537
• Add expose ports layer by @greeddj in #534
• Add support for the draft dns-persist-01 challenge by @beautifulentropy in #536
• Always query DNS records over TCP instead of UDP by @kanashimia in #540

New Contributors

• @oliverpool made their first contribution in #532
• @beautifulentropy made their first contribution in #535
• @greeddj made their first contribution in #534
• @kanashimia made their first contribution in #540

Full Changelog: v2.9.0...v2.10.0

v2.9.0

What's Changed

• wfe: return conflict on re-revocation by @jsha in #505
• Set Content-Type / Retry-After for custom ARI resp by @jsha in #506
• Upgrade to go-jose v4.1.2 by @mcpherrinm in #510
• Update test certificates by @jsha in #513
• Replace agreementRequired problem with userActionRequired by @aarongable in #514
• Revert "Add Location header to finalize response (#85)" by @aarongable in #509
• ca: allow the promotion of first domain/IP to CN in profile by @vancluever in #491
• permit Transfer-Encoding: chunked HTTP request bodies by @benburkert in #515
• Allow generating ECDSA roots and intermediates by @aarongable in #518
• Upgrade go-jose to v4.1.3 by @mcpherrinm in #519
• Return invalidProfile error for unsupported profiles by @alebastr in #521
• Upgrade golangci-lint by @mcpherrinm in #522
• Don't try to update the parent order if there is none by @mkauf in #523
• Auto-generate release notes by @aarongable in #526
• Release: include repo name in command by @aarongable in #527

New Contributors

• @vancluever made their first contribution in #491
• @benburkert made their first contribution in #515
• @alebastr made their first contribution in #521
• @mkauf made their first contribution in #523

Full Changelog: v2.8.0...v2.9.0

v2.8.0

What's Changed

• add overriding of ARI response (#501)

Full Changelog: v2.7.0...v2.8.0

v2.7.0

What's Changed

• Reject extra command line args and fix README invocation by @mcpherrinm in #467
• Simplify KU, EKU, and SKID fields of issued certs by @aarongable in #472
• Add support for ACME Profiles by @aarongable in #473
• Various other updates and fixes

Full Changelog: v2.6.0...v2.7.0

v2.6.0

What's Changed

• chore: update golangci-lint workflow by @ldez in #464
• Implement latest draft-ietf-acme-ari spec by @pgporada in #461
• Document exposing API and management ports when not using docker-compose.yaml by @pgporada in #465

Full Changelog: v2.5.2...v2.6.0

v2.5.2

What's Changed

This fixes EAB which was broken in v2.5.0 and v2.5.1, and adds dns-account-01 support

• ci: remove AppVeyor file by @ldez in #449
• Add "dns-account-01" support from draft-ietf-acme-scoped-dns-challenges by @sheurich in #435
• Update README.md for ghcr.io docker images by @mcpherrinm in #450
• Fix broken externalAcountBinding config by @pgporada in #457
• build(deps): bump golang.org/x/net from 0.21.0 to 0.23.0 by @dependabot in #458
• docs: missing ghcr.io source for docker image by @buchdag in #460
• Require HS256, HS384, or HS512 for EAB by @mcpherrinm in #459

New Contributors

• @buchdag made their first contribution in #460

Full Changelog: v2.5.0...v2.5.2

v2.5.1

Identical to v2.5.0

v2.5.0

What's Changed

• add 'processing' state to challenges by @alexzorin in #382
• Validate CSR signatures and check signature type by @mcpherrinm in #386
• Fix compilation for 32bit by @a16bitsysop in #388
• Add Retry-After header when responding to Order and Authorization object by @moratori in #380
• Update install instructions by @jsha in #389
• Readme: Clarify HTTPS-only text by @aarongable in #397
• Add subproblems by @alexzorin in #383
• Replace deprecated ioutil calls by @pgporada in #400
• fix readme by @n98gt in #410
• README.md: Remove execute bit by @joshtriplett in #413
• Explicitly set the certificate validity period in config by @pgporada in #417
• challtestsrv: implement DoH by @jsha in #423
• Update challtestsrv to 1.3.2 by @jsha in #424
• chisel2.py fixes by @sheurich in #426
• Clarify github and go commands by @zyphlar in #429
• Upgrade Go and dependencies; CI and Docker fixes by @sheurich in #434
• Remove CommonName from issued certificates by @mcpherrinm in #420
• ca: fix regression with newCertificate by @ldez in #441
• Use GitHub Actions by @ldez in #442
• GolangCI-Lint Fixes by @sheurich in #439
• Switch to go-jose v4 by @mcpherrinm in #445
• ca: Pass OCSP Must-Staple from CSR into generated certificate by @wgreenberg in #436
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.0 to 4.0.1 by @dependabot in #446
• CI: Travis -> GitHub Actions; Create Release Binaries and Container Images by @sheurich in #444

New Contributors

• @mcpherrinm made their first contribution in #386
• @a16bitsysop made their first contribution in #388
• @moratori made their first contribution in #380
• @pgporada made their first contribution in #400
• @n98gt made their first contribution in #410
• @joshtriplett made their first contribution in #413
• @sheurich made their first contribution in #426
• @zyphlar made their first contribution in #429
• @wgreenberg made their first contribution in #436

Full Changelog: v2.4.0...v2.5.0

Pebble v2.3.1

Features

• Add CORS support to the frontend.
• Add ability to control the length of Pebble's issuance chains (i.e. add or remove intermediates between the root and the end-entity certificate).
• Add support for honoring NotBefore/NotAfter in issuance requests.

Fixes

• Seed PRNG with current time to prevent predictable nonce rejection patterns.

Our heartfelt thanks to @ldez, @alexzorin, @szepeviktor, @cpu, and @meyskens for their contributions to this release.