Added
- Certbot now stores the Retry-After value given by ACME Renewal Info (ARI) so the value can be respected across multiple Certbot runs. (#10377)
- Added
uv
as a test dependency, and switched mostpip
invocations touv pip
for faster installs. (#10428)
Changed
- Removed final instances of pyopenssl x509 and PKey objects
- Removed
acme.crypto_util.SSLSocket
- Removed
acme.crypto_util.probe_sni
(#10079,
#10381)
- Removed a number of deprecated classes/interfaces
* Removed acme.challenges.TLSALPN01Response
* Removed acme.challenges.TLSALPN01
* Removed acme.standalone.TLSServer
* Removed acme.standalone.TLSALPN01Server
(#10274)
- certbot.ocsp.RevocationChecker.init no longer accepts the parameter
enforce_openssl_binary_usage
and always uses the cryptography Python
library for OCSP checking.
(#10291)
- Python 3.9 support was removed.
(#10389)
- Migrated most functionality from certbot/setup.py
to
certbot/pyproject.toml
(#10402)
- Migrated most functionality from setup.py
to pyproject.toml
for acme,
certbot-apache, and certbot-nginx.
(#10417)
- Migrated most functionality from setup.py
to pyproject.toml
for certbot
dns plugins. (#10425)
- Updated apache TLS configuration options based on changes to Mozilla's
intermediate configuration recommendations.
* Added DHE-RSA-CHACHA20-POLY1305
to SSLCipherSuite
list for better
compliance
* Configured curves using SSLOpenSSLConfCmd
so FFDH won't be used with
OpenSSL 3.0
(#10443)
Fixed
- certbot-apache no longer prints a warning claiming the version of OpenSSL used by Apache is too old when we were unable determine the OpenSSL version. (#10444)
- certbot-nginx no longer uses socket.gethostname when generating self-signed certificates for use as a temporary step of installing certificates as it would sometimes result in strings that are too long to be used in the common name of a certificate. The static domain "temp-certbot-nginx.invalid" is now used instead. (#10447)