v1.4.0

Hey everyone, this release brings some new feature for TLS CA creation, cleans up code and brings some quality of life improvements. Let's get into it!

Features

Add CRL Distribution Point Extension (#234)

As requested in #163 and #192 this release adds another way to distribute CRL files. Previously the files could only be downloaded through the VaulTLS API or Web UI or retrieved from the file system. The X.509 specifications have created an extension to the file format for establishing a standardized way of retrieving those files. This is useful for example if you are a client and want to verify that a TLS server certificate is still valid. The access point should be accessible from the public internet and not require encryption.

An static file server is added to the nginx configuration used in the container image. The port used is 2277. To use the CRL DP extension please expose this port. Ideally map it to the standard HTTP port (80), it should not be using TLS.

Furthermore to add the extension to newly created TLS certificates (existing ones will remain the same) please specify the host where the CRL files are available as environmental variable VAULTLS_CRL_DP_URL. For example: VAULTLS_CRL_DP_URL="http://crl.example.fyi". If this is set on TLS cert creation the CRL DP extension will be added.

❯ openssl x509 -noout -text -in /home/triton/Downloads/LoveLife.p12 
Enter pass phrase for PKCS12 import pass phrase:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            da:d2:84:8e:f2:0c:a4:75
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN=ExampleCA
        Validity
            Not Before: Aug 21 13:48:28 2026 GMT
            Not After : Aug 21 13:48:28 2027 GMT
        Subject: CN=Example
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:ba:b4:3a:62:ac:5b:14:55:d2:8f:bc:e7:a1:bc:
                    58:4e:be:ac:9f:5c:76:8a:cc:74:55:fb:38:67:76:
                    fd:ed:a7:ce:6f:9a:96:0a:ea:dd:47:ba:1f:00:fd:
                    64:68:05:a0:df:25:ac:58:0e:6a:df:dc:e7:91:f0:
                    e0:22:a8:9b:eb
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:example.fyi
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.example.fyi/crl/crl-5.crl

            X509v3 Subject Key Identifier: 
                E3:26:02:61:A4:67:EB:23:37:98:F0:E6:03:3A:65:28:C9:2B:16:05
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:44:02:20:1e:11:62:1e:23:a4:fe:72:bf:a4:24:14:33:cf:
        5c:2c:37:ed:aa:9f:71:0f:21:4d:73:85:ca:5a:9f:f5:25:42:
        02:20:38:c8:0d:6d:57:e4:39:60:f8:05:5d:91:7e:69:f6:dd:
        8d:71:b1:35:4c:a5:75:90:0c:e0:37:f8:3a:91:38:57
No Trusted Uses.
No Rejected Uses.
Alias: Example
Key Id: 26:C7:1F:37:DB:96:07:D1:1B:94:CF:25:3D:C4:A8:F2:EF:ED:D5:C9

Add improved AUD and AZP claim validation in OIDC (#231)

In OpenID Connect, AUD (Audience) identifies the intended recipient or application that must process the token, while AZP (Authorized Party) specifies the client ID of the party to which the token was actually issued. The AUD claim usually only contains the client ID, while the AZP claim is optional. Some OIDC providers such as Zitadel (#219), send multiple values in the AUD claim which need to be trusted. You can now specify trusted audiences (besides the client ID) using a comma-separated list in the VAULTLS_OIDC_ADDITIONAL_AUDIENCES env var. This value is also stored in the settings file, so it must only be specified once and will be remembered. In favor of keeping the frontend simple, this setting is not available there for now.

In addition to improved AUD handling, VaulTLS is now also properly processing the AZP claim by checking if it matches the client ID.

Add option to download all TLS CAs (#232)

Some reverse proxies such as nginx do not allow to specify multiple CA files for client cert validation. To solve this issue, one can concatenate multiple CA pem-encoded files into one large file. As requested by #168 VaulTLS now supports downloading all TLS CAs as one file. Available through the API and Web UI.

Allow private CA for OIDC (#229)

OIDC will not work if the OIDC server is signed with a private CA (#228). Thanks to @divinehawk VaulTLS now supports setting the SSL_CERT_FILE env variable to allow the use of a private certificate authority for the OIDC server.

Bug fixes

Add trim to secret reading (#217)

As reported in #216 when reading a secrets file VaulTLS did not trim the read file. This lead to startup failing due to an additionally read new line character. Fix this issue, by unifying code paths for reading secrets from env or file.

Refactor

Migrate core logic in TLS handling from openssl to rcgen (#233)

While openssl is quite powerful the wrapper library implementation for Rust is quite lacking. Since VaulTLS has to use the Rust-native rcgen library for CRL processing anyway, move as much as possible of the TLS logic to rcgen.

Thanks for using VaulTLS!

Full Changelog: v1.3.0...v1.4.0