fabriziosalmi/certmate v2.53.0

v2.53.0 (certificates for IP addresses)

on GitHub

v2.53.0 (certificates for IP addresses)

Two features, two fixes, and a round of dependency updates.

• A certificate for a public IPv4 address, from Let's Encrypt (#1130). Type the address in the create form's domain field, or send it as domain to POST /api/certificates/create. Let's Encrypt issues for an address only over HTTP-01 and only in its shortlived profile (160 hours), so port 80 of that address must reach CertMate; the form locks the challenge and the profile and says so. The certificate is kept and reached under the name ip- and the address with dashes, the list shows it by its address, and the renewal sweep renews it like any other, about three days before it expires. Verified on Let's Encrypt staging through the API: issued in 9 seconds, the address as the only SAN, renewed and reissued by name. See IP-address certificates.
• The ACME server certifies IPv4 addresses (#1338, RFC 8738). An internal host reached by address, such as a NAS, a BMC or a printer, can get its certificate from CertMate's ACME CA the way a name does. EAB keys take addresses and networks (192.168.1.20, 10.20.0.0/16), an address is proved over http-01 from the address itself, and the certificate names it as an IP address. lego (--domains <address>) and acme.sh (-d <address>) order one in the interoperability job. See the ACME server.
• Fix: the ACME server no longer takes an address for a DNS name. An order for {"type": "dns", "value": "10.0.0.5"} that an EAB key's patterns allowed was issued with a DNS-name SAN 10.0.0.5, which no client accepts. It is refused now, and pointed to the ip type.
• Fix: the renewal sweep reports a re-registration only when it was saved. A certificate on disk with no settings entry is renewed and written back to the settings; when the save dropped the entry, the sweep still counted it as re-registered, after every renewal.
• Security, in the image: filelock 4.2.4 (GHSA-v4x8-3wr5-3wq8, high, in a lock class CertMate does not use; GHSA-567q-5qvw-pf92 and GHSA-9vhv-jxww-xfm5, low, Windows only) and setuptools 84.2.1 (GHSA-xmj3-9gf7-h52w, low, Windows only).
• Security, in the MCP server's lockfile: fast-uri 3.1.9 (GHSA-wjr9-j795-jxcr and GHSA-w74x-v6f9-j3xg, medium; GHSA-333x-w4r6-6crp and GHSA-xhq7-xmqj-769h, low), body-parser 2.4.0 (GHSA-27r3-jxmh-p828), zod 4.6.7 (GHSA-mrhx-c7xc-m3w5, high) and ip-address 10.7.4 (GHSA-rxp7-6hxx-x8q5). The MCP server talks over stdio.

Under the hood: the CI suite runs on four workers with the end-to-end tests after it; make runs every recipe with the virtual environment first on the path, so it runs the tests CI runs; a race in a test's fake SMTP server and a test bound to a calendar date were fixed.

The API contract moves to 2.58 (MINOR): 2.57 lets POST /api/certificates/create take an IPv4 address and adds ip_address to the certificate answers, the create answer and a create job's result; 2.58 lets the ACME server's allowed_identifiers take addresses and networks.