At the time this section was written, it was all about the introduction of support for ECDSA and how users can start taking advantage of that support.
Now that we use ECDSA by default, this piece of documentation probably should serve a new purpose. My idea here is to document the new behavior that we have in 2.0: new key type on new certificates, old certificates will keep their existing key type.
Users may now be going in the reverse direction with their changes ("I got an ECDSA certificate but I need RSA because I have an old load balancer appliance!") so I have also updated some section titles to be less about ECDSA and more about Key Types in general.
Fixes#9442.
* main: set more permissive umask when creating work_dir
This'll guarantee our working dir has the appropriate permissions,
even when a user has a strict umask
* update changelog
Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
* certbot-apache: use httpd for newer RHEL derived distros
A change in RHEL 9 is causing apachectl to error out when used
with additional arguments, resulting in certbot errors. The CentOS
configurator now uses httpd instead for RHEL 9 (and later) derived
distros.
* Single CentOS class which uses the apache_bin option
* soothe mypy
* Always call super()._override_cmds()
* Use the TSIG keyring for the initial SOA request
Helps allow the use of keys in BIND ACLs to help certbot update the correct zone. Previously TSIG was only used for zone updates, rather than for both the authoritative SOA request and zone update.
* Update CHANGELOG.md
* Update AUTHORS.md
* Workaround for mypy failure due to dnspython stubs
As per https://github.com/certbot/certbot/pull/9408#issuecomment-1257868864
Co-authored-by: Alex Zorin <alex@zorin.id.au>
* dont superfluously ask whether to renew, when changing key type
* reorder conditions
this prevents "Certificate not yet due for renewal" being printed
* and replace superfluous mock
* mock renewal.should_renew
* Remove external mock dependency
This also removes the "external-mock" test environment
* remove superfluous ignores
* remove mock warning ignore from pytest.ini
* drop deps on mock in oldest, drop dep on types-mock
Co-authored-by: Alex Zorin <alex@zorin.id.au>
* acme: remove Client and BackwardsCompatibleClientV2
* remove ClientTestBase and some unused variables
* add ClientV2.get_directory
* tweak ToS callback code
* acme: update example to use ClientV2.get_directory
* simplify ToS callback further into one step
* further removal of acmev1-related code
- remove acme.client.ClientBase
- remove acme.mixins.VersionedLEACMEMixin
- remove acme.client.DER_CONTENT_TYPE
- remove various ACMEv1 special cases
- remove acme.messages.ChallengeResources.combinations
* remove .mixins.ResourceMixin, fields.resource, fields.Resource
and resource field from various .message classes.
* simplify acme.messages.Directory:
- remove Directory.register
- remove HasResourceType and GenericHasResourceType
- remove ability to look up Directory resources by anything other
than the exact field name in RFC8555 (section 9.7.5)
* remove acme.messages.OLD_ERROR_PREFIX and support the old prefix
* remove acme.mixins
* reorder imports
* add comment to Directory about resource lookups
* s/new-cert/newOrder/
* get rid of `resource` sillyness in tests
* remove acmev1 terms-of-service support from directory
Will Greenberg