fabriziosalmi/certmate v2.52.1

v2.52.1 (the ACME server, announced, and a round of dependency updates)

on GitHub

v2.52.1 (the ACME server, announced, and a round of dependency updates)

A patch release. It changes no feature and no API: it announces one that is already in the image, and updates dependencies.

• CertMate can be the ACME certificate authority for your internal names (#476). certbot, lego, acme.sh and cert-manager get certificates from it the way they get them from Let's Encrypt, signed by a root of CertMate's own that you install in the trust stores of the machines that connect to those names. Each client is enrolled with an External Account Binding (EAB) key that says which names it may order. It has been in the image since v2.51.1 and stays off by default. See the ACME server.
• Security: opentelemetry-api 1.45.1 (GHSA-xcq7-p3pf-p88h, moderate). Versions up to 1.45.0 parse the W3C tracestate header in quadratic time. The image ships it as a dependency of google-api-core, which only adds trace context to outbound requests and never parses an inbound header, so CertMate's endpoints do not reach the parse. Updated because the fix exists.
• Dependencies: authlib 1.9.1, SQLAlchemy 2.1.6 and boto3 1.43.114 in the image; hono 4.13.13 in the MCP server's lockfile (GHSA-5r4p-p66f-jhc7, which concerns its static file serving; the MCP server talks over stdio and serves no HTTP).

The API contract is unchanged (2.56).

The ACME server

What it does

• Issues for internal names, to certbot, lego, acme.sh and cert-manager, from a root made the first time it is needed (RSA 4096, ten years). It is not a public CA: nothing outside your trust stores trusts its root.
• Holds each client to its names. An EAB key carries the patterns (nas.lab.internal, *.lab.internal) every order of the accounts it enrolled must match; an order outside them is refused before anything is fetched.
• Proves each name on every order, over http-01 or dns-01; wildcards over dns-01 only. The http-01 fetch is guarded: no loopback, link-local or cloud metadata addresses, for the name or any redirect.
• Certificates of 45 days by default (1 to 365), with ACME Renewal Information that suggests days 30 to 37.5, revocation by the account, the certificate's key or an admin, and a CRL at /acme/crl.
• Measured against real clients. lego, acme.sh and cert-manager run against it in the interoperability job, which also checks each client's documented renewal behaviour; certbot's ACME library runs in the test suite.

Turning it on

CertMate must be served over HTTPS (ACME requires it), then Settings → ACME → Serve ACME, install the root from /acme/root, and create an EAB key: its HMAC key is shown once, with the commands for each client filled in. The steps, the options and the limits are in the ACME server.

Not supported: tls-alpn-01, and IP address identifiers.