mirror of
https://github.com/apache/httpd.git
synced 2025-08-16 17:04:42 +00:00
51a214821c
- Added support for ACME External Account Binding (EAB).
Use the new directive `MDExternalAccountBinding` to provide the
server with the value for key identifier and hmac as provided by
your CA.
While working on some servers, EAB handling is not uniform
across CAs. First tests with a Sectigo Certificate Manager in
demo mode are successful. But ZeroSSL, for example, seems to
regard EAB values as a one-time-use-only thing, which makes them
fail if you create a seconde account or retry the creation of the
first account with the same EAB.
- The directive 'MDCertificateAuthority' now checks if its parameter
is a http/https url or one of a set of known names. Those are
'LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' and 'Buypass-Test'
for now and they are not case-sensitive.
The default of LetsEncrypt is unchanged.
- `MDContactEmail` can now be specified inside a `<MDomain dnsname>`
section.
- Treating 401 HTTP status codes for orders like 403, since some ACME
servers seem to prefer that for accessing oders from other accounts.
- When retrieving certificate chains, try to read the repsonse even
if the HTTP Content-Type is unrecognized.
- Fixed a bug that reset the error counter of a certificate renewal
and prevented the increasing delays in further attempts.
- Fixed the renewal process giving up every time on an already existing
order with some invalid domains. Now, if such are seen in a previous
order, a new order is created for a clean start over again.
See <https://github.com/icing/mod_md/issues/268>
- Fixed a mixup in md-status handler when static certificate files
and renewal was configured at the same time.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1894610 13f79535-47bb-0310-9956-ffa450edef68
32 lines
1.8 KiB
Plaintext
32 lines
1.8 KiB
Plaintext
*) mod_md: adding v2.4.8 with the following changes
|
|
- Added support for ACME External Account Binding (EAB).
|
|
Use the new directive `MDExternalAccountBinding` to provide the
|
|
server with the value for key identifier and hmac as provided by
|
|
your CA.
|
|
While working on some servers, EAB handling is not uniform
|
|
across CAs. First tests with a Sectigo Certificate Manager in
|
|
demo mode are successful. But ZeroSSL, for example, seems to
|
|
regard EAB values as a one-time-use-only thing, which makes them
|
|
fail if you create a seconde account or retry the creation of the
|
|
first account with the same EAB.
|
|
- The directive 'MDCertificateAuthority' now checks if its parameter
|
|
is a http/https url or one of a set of known names. Those are
|
|
'LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' and 'Buypass-Test'
|
|
for now and they are not case-sensitive.
|
|
The default of LetsEncrypt is unchanged.
|
|
- `MDContactEmail` can now be specified inside a `<MDomain dnsname>`
|
|
section.
|
|
- Treating 401 HTTP status codes for orders like 403, since some ACME
|
|
servers seem to prefer that for accessing oders from other accounts.
|
|
- When retrieving certificate chains, try to read the repsonse even
|
|
if the HTTP Content-Type is unrecognized.
|
|
- Fixed a bug that reset the error counter of a certificate renewal
|
|
and prevented the increasing delays in further attempts.
|
|
- Fixed the renewal process giving up every time on an already existing
|
|
order with some invalid domains. Now, if such are seen in a previous
|
|
order, a new order is created for a clean start over again.
|
|
See <https://github.com/icing/mod_md/issues/268>
|
|
- Fixed a mixup in md-status handler when static certificate files
|
|
and renewal was configured at the same time.
|
|
|