fabriziosalmi/certmate v2.51.0

v2.51.0 (a setup wizard that says what credential to create and which DNS providers this instance can use, and a Cloudflare wait of 20 seconds instead of 60)

on GitHub

v2.51.0 (a setup wizard that says what credential to create and which DNS providers this instance can use, and a Cloudflare wait of 20 seconds instead of 60)

A minor release, about the first certificate.

• The setup wizard says, for each DNS provider, what credential to create and where its guide is (#1287), and marks the providers this instance cannot issue with, which it now asks the instance about (#1288).
• Cloudflare waits 20 seconds for its record instead of 60, from a measurement (#1286). On a fresh install that wait was 60 of the 98 seconds from the first Quick Start command to a first certificate.
• A new route, GET /api/dns/providers, says which DNS providers this instance can issue with (#1288).

The API contract moves to 2.50 (MINOR: a new endpoint).

Read this before upgrading

If you use Cloudflare

New Cloudflare certificates wait 20 seconds for the challenge record, not 60. A 60 stored by 2.50.2 or earlier is read as the old default and becomes 20; any other value you set stays as it is. If your zone propagates more slowly, select Cloudflare in Settings > DNS and raise its propagation wait (dns_propagation_seconds.cloudflare in POST /api/settings).

Certificates issued before this release keep the wait certbot stored in their renewal configuration (60 seconds, unless you had changed it) until they are issued again. This changes new certificates, not the renewal of existing ones.

Added

• The setup wizard says what credential to create (#1287). Step 2 asked for a DNS provider's credentials and said nothing about them, so a token with the wrong permissions passed the wizard and failed at the first issuance, after the propagation wait. Under each provider's fields there is now a line on what to create, taken from the plugin's own documentation or from DNS providers, and a link to its section. A provider with no such source gets the link only: a guess about another vendor's permission model would be worse than nothing. The Scaleway field no longer says pip install, in an image that has no pip.
• The setup wizard marks the providers this instance cannot use (#1287, #1288). The published image carries the certbot plugins of 20 providers out of 29, and a provider whose plugin is missing is refused at issuance, after its credentials have been saved. The wizard now asks the instance, dims those providers and says why: no working plugin (Namecheap), the extended build (Hurricane Electric, Dynu) or a derived image (Scaleway, PowerDNS). An image built with EXTRA_REQUIREMENTS=requirements-extended.txt is not told it lacks Hurricane Electric and Dynu.
• GET /api/dns/providers (viewer, contract 2.50, #1288). For every supported provider: the certbot plugin it needs, and whether this instance can issue with it, by the rule the issuance preflight applies. When certbot cannot be asked, available is null: unknown, not missing. See the API reference.

Changed

• Cloudflare waits 20 seconds for its record, not 60 (#1286). The plugin's own default is 10, and CertMate passed 60. Measured from fresh instances of the 2.50.2 image, on Let's Encrypt staging, each issuance on a new name:

20 is twice the shortest wait that never failed, not the minimum. See "Not verified" for the limits of this measurement.

Fixed

• A create refused for a missing email pointed at DNS (#1285). A create with no contact email anywhere answered "Email not configured" with the hint "Check your DNS provider settings", so the reader went to check DNS credentials that were fine. The hint now says where the email is set: on the CA account under Settings > CA, or for the whole instance. Found while timing the first certificate on a fresh install, where a create made before the first-run screen gets exactly this answer.

How it was checked

• The time to a first certificate, measured on clean Debian 13 machines before these changes: 97.9 seconds with Docker (27.0 to pull, 1.2 to healthy, 69.2 to issue) and 95.3 with the installer (26.7 to install, 68.4 to issue). 60 seconds of each issuance was the Cloudflare wait.
• The new wait on a build of #1286: a fresh container stores 20, three staging issuances took 28.2, 28.9 and 37.7 seconds, and the new certificates' renewal configuration records 20.
• Two images built for #1288, each a fresh instance, the wizard driven in a browser, with the prediction written first: the default image can issue with 24 providers of 29 and the wizard dims the other 5; the extended build with 26, and Hurricane Electric and Dynu carry no notice. With the route made to fail, the wizard keeps the fixed notices.
• Deliberate breakages. Taking each change back out failed its tests: #1285 (the DNS hint), #1286 (the defaults back at 60: 10 failures; without the migration: 7), #1287 (a broken anchor, pip install put back, a notice removed, a permission dropped, a missing or unpinned source), #1288 (six mutations, each caught).
• The end-to-end bench, rebuilt from main at 845c3e9, so running the image this release builds: healthy, contract 2.50, certbot 5.8.0. GET /api/dns/providers answered 24 of 29, with the same five missing as on the local builds. A new certificate was issued from the private CA over HTTP-01, and the scheduler's real renewal job renewed the 14 certificates that were due and left alone the one issued a minute earlier; the webhook receiver got 14 certificate_renewed and the new name's certificate_created.
• The suite (9,099 tests) on main at 845c3e9. The release gate runs the suite, the browser tests and real certificates from Let's Encrypt staging on the release commit.

Not verified

• The 20-second wait beyond one setup. One network, one Cloudflare zone, about twenty minutes, staging only; 33 samples cannot show rare events. A slower zone needs its wait raised, as above.
• The time to a first certificate with the new default, end to end on a fresh host. The issuance alone went from 68 to 69 seconds to 28 to 38; the whole run was not measured again.
• The Helm chart's time to a first certificate, which was not measured.