fabriziosalmi/certmate v2.50.1

v2.50.1 (a client certificate renews with the country and state it was issued with)

on GitHub

v2.50.1 (a client certificate renews with the country and state it was issued with)

A patch release. A client certificate issued with an explicit country and state renewed with the default ones instead (#1256); it now keeps them. The API contract moves from 2.48 to 2.49.

Read this before upgrading

Nothing needs to change on your side.

Client certificates already renewed

A client certificate issued with a country or state other than the default, and renewed before this release, was renewed as C=CH, ST=Switzerland (or with the CERTMATE_CLIENT_CERT_DEFAULT_* values in force at the time, since v2.50.0). That renewed certificate carries the default, and its next renewal keeps what it carries. To give such an identity back the country and state it should have, issue a new certificate with them.

A certificate not yet renewed is not affected: its first renewal under this release keeps its country and state.

If you call the API

• 2.49 a client certificate's record (create, renew, list, get) gains country and state, the C and ST of its subject.

Every change is in docs/api.md.

Fixed

• A client certificate renewal dropped the country and state it was issued with (#1256). The certificate's record kept the common name, email, organisation and unit, but not the country or the state, and a renewal re-issues from that record, so it took the default. An mTLS rule matching on the subject stopped matching after a renewal nobody chose, and the nightly sweep renews unattended.
  • The record now carries the country and state the certificate holds, read off the certificate itself, so a CSR's subject is kept as well.
  • A certificate issued before this release has neither field in its record, and its renewal reads them off the certificate it replaces.
  • The default applies only to a new certificate that names neither. A CERTMATE_CLIENT_CERT_DEFAULT_* value changed after issuance does not rename an existing identity.

How it was checked

• The end-to-end bench, with an upgrade in between. A client certificate was created as C=IT, ST=Lazio on v2.50.0 code, with a record that had neither field. The bench was then rebuilt from main at 1dabbff. The renewal came out as C=IT, ST=Lazio, from the same CA, and the new record and GET /api/client-certs/<identifier> answered IT and Lazio.
• Tests for the reported case, the record against the certificate, a default changed after issuance, a certificate issued before the fields existed, and a CSR's subject.
  • With the previous code the five behavioural tests fail, and the control (a new certificate takes the default) passes.
  • Without reading the old certificate, the test for one issued before the fields existed fails.
• The suite (8,927 tests) on main at 21b6921. The release gate runs the suite, the browser tests and real certificates from Let's Encrypt staging on the release commit.