diff --git a/acme/setup.py b/acme/setup.py index 350bf80f4..880c8d40d 100644 --- a/acme/setup.py +++ b/acme/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' setup( version=version, diff --git a/certbot-apache/setup.py b/certbot-apache/setup.py index d3e43f81d..43f6e753e 100644 --- a/certbot-apache/setup.py +++ b/certbot-apache/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ # We specify the minimum acme and certbot version as the current plugin diff --git a/certbot-ci/setup.py b/certbot-ci/setup.py index 91a34c358..880c8d40d 100644 --- a/certbot-ci/setup.py +++ b/certbot-ci/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '0.32.0.dev0' +version = '5.1.0.dev0' setup( version=version, diff --git a/certbot-compatibility-test/setup.py b/certbot-compatibility-test/setup.py index 350bf80f4..880c8d40d 100644 --- a/certbot-compatibility-test/setup.py +++ b/certbot-compatibility-test/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' setup( version=version, diff --git a/certbot-dns-cloudflare/setup.py b/certbot-dns-cloudflare/setup.py index 8f9d8a103..a1d93d207 100644 --- a/certbot-dns-cloudflare/setup.py +++ b/certbot-dns-cloudflare/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ # for now, do not upgrade to cloudflare>=2.20 to avoid deprecation warnings and the breaking diff --git a/certbot-dns-digitalocean/setup.py b/certbot-dns-digitalocean/setup.py index 1e5045448..ba3171bb2 100644 --- a/certbot-dns-digitalocean/setup.py +++ b/certbot-dns-digitalocean/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'python-digitalocean>=1.15.0', # 1.15.0 or newer is recommended for TTL support diff --git a/certbot-dns-dnsimple/setup.py b/certbot-dns-dnsimple/setup.py index ef73d648e..8fb7e7b04 100644 --- a/certbot-dns-dnsimple/setup.py +++ b/certbot-dns-dnsimple/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ # This version of lexicon is required to address the problem described in diff --git a/certbot-dns-dnsmadeeasy/setup.py b/certbot-dns-dnsmadeeasy/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-dnsmadeeasy/setup.py +++ b/certbot-dns-dnsmadeeasy/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-dns-gehirn/setup.py b/certbot-dns-gehirn/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-gehirn/setup.py +++ b/certbot-dns-gehirn/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-dns-google/setup.py b/certbot-dns-google/setup.py index 322aeab3e..783ef9de0 100644 --- a/certbot-dns-google/setup.py +++ b/certbot-dns-google/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'google-api-python-client>=1.6.5', diff --git a/certbot-dns-linode/setup.py b/certbot-dns-linode/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-linode/setup.py +++ b/certbot-dns-linode/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-dns-luadns/setup.py b/certbot-dns-luadns/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-luadns/setup.py +++ b/certbot-dns-luadns/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-dns-nsone/setup.py b/certbot-dns-nsone/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-nsone/setup.py +++ b/certbot-dns-nsone/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-dns-ovh/setup.py b/certbot-dns-ovh/setup.py index f06d396ac..f9afe37f5 100644 --- a/certbot-dns-ovh/setup.py +++ b/certbot-dns-ovh/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.15.1', diff --git a/certbot-dns-rfc2136/setup.py b/certbot-dns-rfc2136/setup.py index acc43965a..a3ca7913e 100644 --- a/certbot-dns-rfc2136/setup.py +++ b/certbot-dns-rfc2136/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ # This version was chosen because it is the version packaged in RHEL 9 and Debian unstable. It diff --git a/certbot-dns-route53/setup.py b/certbot-dns-route53/setup.py index 6240e28df..83c1f1c05 100644 --- a/certbot-dns-route53/setup.py +++ b/certbot-dns-route53/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'boto3>=1.20.34', diff --git a/certbot-dns-sakuracloud/setup.py b/certbot-dns-sakuracloud/setup.py index ffb41336c..eff853a24 100644 --- a/certbot-dns-sakuracloud/setup.py +++ b/certbot-dns-sakuracloud/setup.py @@ -2,7 +2,7 @@ import os from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ 'dns-lexicon>=3.14.1', diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py index ba052a46f..742788995 100644 --- a/certbot-nginx/setup.py +++ b/certbot-nginx/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '5.0.0.dev0' +version = '5.1.0.dev0' install_requires = [ # We specify the minimum acme and certbot version as the current plugin diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md index e9ebf224a..b48cf17fe 100644 --- a/certbot/CHANGELOG.md +++ b/certbot/CHANGELOG.md @@ -4,6 +4,67 @@ Certbot adheres to [Semantic Versioning](https://semver.org/). +## 5.0.0 - 2025-09-02 + +### Added + +- Certbot now stores the Retry-After value given by ACME Renewal Info (ARI) so + the value can be respected across multiple Certbot runs. + ([#10377](https://github.com/certbot/certbot/issues/10377)) +- Added `uv` as a test dependency, and switched most `pip` invocations to `uv + pip` for faster installs. + ([#10428](https://github.com/certbot/certbot/issues/10428)) + +### Changed + +- Removed final instances of pyopenssl x509 and PKey objects + * Removed `acme.crypto_util.SSLSocket` + * Removed `acme.crypto_util.probe_sni` + + ([#10079](https://github.com/certbot/certbot/issues/10079), + [#10381](https://github.com/certbot/certbot/issues/10381)) +- Removed a number of deprecated classes/interfaces + * Removed `acme.challenges.TLSALPN01Response` + * Removed `acme.challenges.TLSALPN01` + * Removed `acme.standalone.TLSServer` + * Removed `acme.standalone.TLSALPN01Server` + + ([#10274](https://github.com/certbot/certbot/issues/10274)) +- certbot.ocsp.RevocationChecker.__init__ no longer accepts the parameter + `enforce_openssl_binary_usage` and always uses the cryptography Python + library for OCSP checking. + ([#10291](https://github.com/certbot/certbot/issues/10291)) +- Python 3.9 support was removed. + ([#10389](https://github.com/certbot/certbot/issues/10389)) +- Migrated most functionality from `certbot/setup.py` to + `certbot/pyproject.toml` + ([#10402](https://github.com/certbot/certbot/issues/10402)) +- Migrated most functionality from `setup.py` to `pyproject.toml` for acme, + certbot-apache, and certbot-nginx. + ([#10417](https://github.com/certbot/certbot/issues/10417)) +- Migrated most functionality from `setup.py` to `pyproject.toml` for certbot + dns plugins. ([#10425](https://github.com/certbot/certbot/issues/10425)) +- Updated apache TLS configuration options based on changes to Mozilla's + intermediate configuration recommendations. + * Added `DHE-RSA-CHACHA20-POLY1305` to `SSLCipherSuite` list for better + compliance + * Configured curves using `SSLOpenSSLConfCmd` so FFDH won't be used with + OpenSSL 3.0 + + ([#10443](https://github.com/certbot/certbot/issues/10443)) + +### Fixed + +- certbot-apache no longer prints a warning claiming the version of OpenSSL + used by Apache is too old when we were unable determine the OpenSSL version. + ([#10444](https://github.com/certbot/certbot/issues/10444)) +- certbot-nginx no longer uses socket.gethostname when generating self-signed + certificates for use as a temporary step of installing certificates as it + would sometimes result in strings that are too long to be used in the common + name of a certificate. The static domain "temp-certbot-nginx.invalid" is now + used instead. ([#10447](https://github.com/certbot/certbot/issues/10447)) + + ## 4.2.0 - 2025-08-05 ### Added diff --git a/certbot/docs/cli-help.txt b/certbot/docs/cli-help.txt index 51291fb11..36cdb32b5 100644 --- a/certbot/docs/cli-help.txt +++ b/certbot/docs/cli-help.txt @@ -142,7 +142,7 @@ options: case, and to know when to deprecate support for past Python versions and flags. If you wish to hide this information from the Let's Encrypt server, set this to - "". (default: CertbotACMEClient/4.2.0 (certbot; + "". (default: CertbotACMEClient/5.0.0 (certbot; OS_NAME OS_VERSION) Authenticator/XXX Installer/YYY (SUBCOMMAND; flags: FLAGS) Py/major.minor.patchlevel). The flags encoded in the user agent are: --duplicate, diff --git a/certbot/src/certbot/__init__.py b/certbot/src/certbot/__init__.py index 1247fcd3d..d991354e1 100644 --- a/certbot/src/certbot/__init__.py +++ b/certbot/src/certbot/__init__.py @@ -1,4 +1,4 @@ """Certbot client.""" # version number like 1.2.3a0, must have at least 2 parts, like 1.2 -__version__ = '5.0.0.dev0' +__version__ = '5.1.0.dev0' diff --git a/letstest/setup.py b/letstest/setup.py index 97c5f01f1..880c8d40d 100644 --- a/letstest/setup.py +++ b/letstest/setup.py @@ -1,6 +1,6 @@ from setuptools import setup -version = '1.0' +version = '5.1.0.dev0' setup( version=version, diff --git a/newsfragments/10079.changed b/newsfragments/10079.changed deleted file mode 100644 index 4fff56d7f..000000000 --- a/newsfragments/10079.changed +++ /dev/null @@ -1,3 +0,0 @@ -Removed final instances of pyopenssl x509 and PKey objects -* Removed `acme.crypto_util.SSLSocket` -* Removed `acme.crypto_util.probe_sni` diff --git a/newsfragments/10274.changed b/newsfragments/10274.changed deleted file mode 100644 index ab55fe715..000000000 --- a/newsfragments/10274.changed +++ /dev/null @@ -1,5 +0,0 @@ -Removed a number of deprecated classes/interfaces -* Removed `acme.challenges.TLSALPN01Response` -* Removed `acme.challenges.TLSALPN01` -* Removed `acme.standalone.TLSServer` -* Removed `acme.standalone.TLSALPN01Server` diff --git a/newsfragments/10291.changed b/newsfragments/10291.changed deleted file mode 100644 index 48da3f2dc..000000000 --- a/newsfragments/10291.changed +++ /dev/null @@ -1 +0,0 @@ -certbot.ocsp.RevocationChecker.__init__ no longer accepts the parameter `enforce_openssl_binary_usage` and always uses the cryptography Python library for OCSP checking. diff --git a/newsfragments/10377.added b/newsfragments/10377.added deleted file mode 100644 index 44d53b2a2..000000000 --- a/newsfragments/10377.added +++ /dev/null @@ -1 +0,0 @@ -Certbot now stores the Retry-After value given by ACME Renewal Info (ARI) so the value can be respected across multiple Certbot runs. diff --git a/newsfragments/10381.changed b/newsfragments/10381.changed deleted file mode 100644 index 4fff56d7f..000000000 --- a/newsfragments/10381.changed +++ /dev/null @@ -1,3 +0,0 @@ -Removed final instances of pyopenssl x509 and PKey objects -* Removed `acme.crypto_util.SSLSocket` -* Removed `acme.crypto_util.probe_sni` diff --git a/newsfragments/10389.changed b/newsfragments/10389.changed deleted file mode 100644 index 4a7232179..000000000 --- a/newsfragments/10389.changed +++ /dev/null @@ -1 +0,0 @@ -Python 3.9 support was removed. diff --git a/newsfragments/10402.changed b/newsfragments/10402.changed deleted file mode 100644 index 2774bd8e2..000000000 --- a/newsfragments/10402.changed +++ /dev/null @@ -1 +0,0 @@ -Migrated most functionality from `certbot/setup.py` to `certbot/pyproject.toml` diff --git a/newsfragments/10417.changed b/newsfragments/10417.changed deleted file mode 100644 index aecb45185..000000000 --- a/newsfragments/10417.changed +++ /dev/null @@ -1 +0,0 @@ -Migrated most functionality from `setup.py` to `pyproject.toml` for acme, certbot-apache, and certbot-nginx. \ No newline at end of file diff --git a/newsfragments/10425.changed b/newsfragments/10425.changed deleted file mode 100644 index 0bcff5f74..000000000 --- a/newsfragments/10425.changed +++ /dev/null @@ -1 +0,0 @@ -Migrated most functionality from `setup.py` to `pyproject.toml` for certbot dns plugins. \ No newline at end of file diff --git a/newsfragments/10428.added b/newsfragments/10428.added deleted file mode 100644 index 7e50dbc70..000000000 --- a/newsfragments/10428.added +++ /dev/null @@ -1 +0,0 @@ -Added `uv` as a test dependency, and switched most `pip` invocations to `uv pip` for faster installs. diff --git a/newsfragments/10443.changed b/newsfragments/10443.changed deleted file mode 100644 index ccf7aaa8b..000000000 --- a/newsfragments/10443.changed +++ /dev/null @@ -1,3 +0,0 @@ -Updated apache TLS configuration options based on changes to Mozilla's intermediate configuration recommendations. -* Added `DHE-RSA-CHACHA20-POLY1305` to `SSLCipherSuite` list for better compliance -* Configured curves using `SSLOpenSSLConfCmd` so FFDH won't be used with OpenSSL 3.0 diff --git a/newsfragments/10444.fixed b/newsfragments/10444.fixed deleted file mode 100644 index ccd999e85..000000000 --- a/newsfragments/10444.fixed +++ /dev/null @@ -1 +0,0 @@ -certbot-apache no longer prints a warning claiming the version of OpenSSL used by Apache is too old when we were unable determine the OpenSSL version. diff --git a/newsfragments/10447.fixed b/newsfragments/10447.fixed deleted file mode 100644 index e8c4c7df7..000000000 --- a/newsfragments/10447.fixed +++ /dev/null @@ -1 +0,0 @@ -certbot-nginx no longer uses socket.gethostname when generating self-signed certificates for use as a temporary step of installing certificates as it would sometimes result in strings that are too long to be used in the common name of a certificate. The static domain "temp-certbot-nginx.invalid" is now used instead.