fabriziosalmi/certmate v2.50.0

v2.50.0 (paginated certificate lists, a palette that finds any name a certificate covers, a client CA named by its deployment, and translations that match their English)

on GitHub

v2.50.0 (paginated certificate lists, a palette that finds any name a certificate covers, a client CA named by its deployment, and translations that match their English)

A minor release.

• The dashboard. The server and client certificate lists are paginated (#1226), and the ⌘K palette finds a certificate by any name it covers (#1249).
• The inventory. Its table sorts by its columns and lists every endpoint of a certificate on hover (#1252).
• Client certificates. A deployment can name its client CA, and the country and state of the client certificates it issues, from the environment (#1251).
• The translated documentation. Every translated page outside api.md, 60 in all, now matches its English page. 45 of them were translated again (#1253, #1257). The freshness gate now checks each page against its English, so a stamp can no longer claim what the page does not do (#1255).

The API contract stays at 2.48.

Read this before upgrading

Nothing needs to change on your side.

• No API, setting or file format changes.
• A client certificate issued without a country or state still gets C=CH, ST=Switzerland, unless the new variables below say otherwise.
• The client CA is never replaced because a variable changed.

The certificate lists have pages

The server and client certificate lists show 25, 50 or 100 rows per page, with Previous and Next, and remember the page size. Searching stays in the ⌘K palette, which now also matches the other names on a certificate. The API still returns complete lists: this is pagination in the dashboard only.

Backups and the Quick Start's docker run

The Docker page's upgrade example used to re-run docker run with bind mounts that its own Quick Start never made. It now uses the Quick Start's named volumes. The page also says what was missing: backups are written to /app/backups, which the Quick Start does not mount, so a backup taken before docker rm goes with the container. If you run CertMate with the Quick Start's command, mount /app/backups (for example -v certmate_backups:/app/backups), or download backups before removing the container.

New

• The certificate lists are paginated (#1226, contributed by QuentinBtd).
  • 25, 50 or 100 rows per page, with Previous and Next, and the page size is remembered.
  • Deployment checks start with the visible page, and the Deployed count still covers every certificate.
• The ⌘K palette finds a certificate by any name it covers (#1249; #1247). A search for www.example.com finds the example.com certificate when that is one of its SANs, and the result says which SAN matched.
• The inventory table sorts by its columns (#1252, contributed by IkerSolozabal).
  • Expiry sorts by date, key by size, and endpoints by count; records with nothing in a column go last.
  • Hovering a certificate's endpoints lists every one of them, not only the first and a count.
• The client CA and the client certificate defaults can come from the environment (#1251, contributed by IkerSolozabal).
  • CERTMATE_CLIENT_CA_COUNTRY, _STATE, _ORGANIZATION, _ORGANIZATIONAL_UNIT and _COMMON_NAME name the client CA when it is created, on the first start or by a reset without a subject. client_ca_subject in settings still wins.
  • CERTMATE_CLIENT_CERT_DEFAULT_COUNTRY and _STATE replace CH / Switzerland for client certificates issued without them: create requests that leave them out, CSV batches and renewals.
  • A country that is not a two-letter code stops the start, naming the variable.

Fixed

• The deployment badge no longer widens its column while it checks (#1250, contributed by QuentinBtd). It shows a spinner, with the label kept for screen readers.
• The documentation says what the code does.
  • docs/architecture.md documented a creation route that does not exist (POST /api/certificates; creation is /api/certificates/create) and one removed in v2.2.0, said CertMate can run multiple instances thirty lines above saying it cannot, and listed three of the eight CA providers (#1254).
  • docs/dns-providers.md rendered the EfficientIP section inside a code block, because the PowerDNS example closed one line early (#1257).
  • docs/docker.md listed linux/arm/v6, which the base image does not have, and docs/testing.md listed ten test files that exist nowhere (#1258).
• The early-renewal guard measures a certificate's age at the instant the sweep decided on (#1260). With 64-day certificates, as Let's Encrypt staging now issues, a renewal driven by the CA's window could be deferred in the release gate. Production behaviour does not change.
• The base image gate judges the platforms CertMate publishes (#1248). A tag that moved only for platforms CertMate does not build, as it did on 2026-10-16 for riscv64, no longer counts as a pinned image left behind.

Dependencies

• boto3 1.43.111, dnspython 2.9.0, ansible-core 2.21.5 and ruff 0.17.0, with their lockfiles (#1245).
• SQLAlchemy >= 2.1.4 (#1233).
• @modelcontextprotocol/sdk 1.32.1 for the MCP server (#1231).
• Seven GitHub Actions updates (#1234).

How it was checked

• The end-to-end bench with a private CA, rebuilt from main at ccb9eab, with the scheduler's real renewal job:
  • the client CA was the same after the upgrade: the same key, subject and serial;
  • a client certificate created without a country or state carried C=CH, ST=Switzerland, as before, from the same CA;
  • a new certificate was issued from the private CA over HTTP-01;
  • the real renewal job renewed the 12 certificates that were due, and left alone the one issued a minute earlier;
  • the webhook receiver got 12 certificate_renewed.
• The dashboard in a browser. The browser suite ran against #1250 and #1252 (142 passed each); the 2 tests that need a Cloudflare token did not run there.
• Deliberate breakages. In #1251, putting back the old default resolution or taking the environment out of the factory each failed its tests. In #1252, the old script and template failed 12 and 15 of its 17 tests. Each rule of the translation gate (#1255, #1257) was disabled in turn and caught.
• The suite (8,921 tests) on main at 894a0ce. The release gate runs the suite, the browser tests and real certificates from Let's Encrypt staging on the release commit.

Not verified

• The client CA variables in a container started through the shipped compose files. The tests cover the empty values those files pass, and create_app() end to end; no container was started with them set.
• The pagination with a large estate in a browser. The browser suite covers the lists and their controls with a handful of certificates.