Skip to content

Commit 3daef5e

Browse files
cpudjc
authored andcommitted
docs: update CHANGELOG for 0.13.0
1 parent 17032f0 commit 3daef5e

File tree

2 files changed

+159
-0
lines changed

2 files changed

+159
-0
lines changed

rcgen/CHANGELOG.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,75 @@
11

22
# Changes
33

4+
## Release 0.13.0 - March XX, 2024
5+
6+
Breaking changes:
7+
8+
- The API used to create/issue key pairs, certificates, certificate signing
9+
requests (CSRs), and certificate revocation lists (CRLs) has been
10+
restructured to emphasize consistency and avoid common errors with
11+
serialization.
12+
13+
For each concrete type (cert, CSR, CRL) the process is now the same:
14+
15+
0. generate or load a key pair and any information about issuers required.
16+
1. create parameters, customizing as appropriate.
17+
2. call a generation `fn` on the parameters, providing subject key pair and
18+
issuer information and as appropriate.
19+
3. call serialization `fn`s on the finalized type, obtaining DER or PEM.
20+
21+
For more information, see [rcgen/docs/0.12-to-0.13.md].
22+
23+
- Throughout the API DER inputs are now represented using types from the Rustls
24+
`rustls-pki-types` crate, e.g. `PrivateKeyDer`, `CertificateDer`,
25+
`CertificateSigningRequestDer`. Contributed by
26+
[Tudyx](https://github.com/tudyx).
27+
28+
- String types used in `SanType` and `DnValue` enums for non-UTF8 string types
29+
have been replaced with more specific types that prevent representation of
30+
illegal values. E.g. `Ia5String`, `BmpString`, `PrintableString`,
31+
`TeletexString`, and `UniversalString`. Contributed by
32+
[Tudyx](https://github.com/tudyx).
33+
34+
- Method names starting with `get_` have been renamed to match Rust convention:
35+
`CertificateRevocationList::get_params()` -> `params()`
36+
`Certificate::get_params()` -> `params()`
37+
`Certificate::get_key_identifier()` -> `Certificate::key_identifier()`
38+
`Certificate::get_times()` -> `Certificate::times()`
39+
40+
Added:
41+
42+
- RSA key generation support has been added. This support requires using the
43+
`aws-lc-rs` feature. By default using `KeyPair::generate()` with
44+
an RSA `SignatureAlgorithm` will generate an RSA 2048 keypair. See
45+
`KeyPair::generate_rsa_for()` for support for RSA 2048, 3072 and 4096 key sizes.
46+
47+
- Support for ECDSA P521 signatures and key generation has been added when using
48+
the `aws-lc-rs` feature. Contributed by [Alvenix](https://github.com/alvenix).
49+
50+
- Support for loading private keys that may be PKCS8, PKCS1, or SEC1 has been
51+
added when using the `aws-lc-rs` feature. Without this feature private keys
52+
must be PKCS8. See `KeyPair::from_pem_and_sign_algo()` and
53+
`KeyPair::from_der_and_sign_algo()` for more information. Contributed by
54+
[Alvenix](https://github.com/alvenix).
55+
56+
- Support has been added for Subject Alternative Name (SAN) names of type
57+
`OtherName`. Contributed by [Tudyx](https://github.com/tudyx).
58+
59+
- Support has been added for specifying custom "other" OIDs in extended key
60+
usage. Contributed by [Tudyx](https://github.com/tudyx).
61+
62+
- Support has been added for building rcgen _without_ cryptography by omitting
63+
the new (default-enabled) `crypto` feature flag. Contributed by
64+
[corrideat](https://github.com/corrideat).
65+
66+
- Support for using `aws-lc-rs` in `fips` mode can now be activated by using the
67+
`fips` feature in combination with the `aws-lc-rs` feature. Contributed by
68+
[BiagioFesta](https://github.com/biagiofesta).
69+
70+
- A small command-line tool for certificate generation (`rustls-cert-gen`) was
71+
added. Contributed by [tbro](https://github.com/tbro).
72+
473
## Release 0.12.1 - January 25th, 2024
574

675
- RFC 5280 specifies that a serial number must not be larger than 20 octets in

rcgen/docs/0.12-to-0.13.md

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# Rcgen 0.12 to 0.13 Migration Guide
2+
3+
This document is a meant to be a helpful guide for some of the API changes made
4+
between rcgen 0.12 and 0.13. For information on other changes in 0.13 see
5+
[rcgen/CHANGELOG.md].
6+
7+
## Key Pairs
8+
9+
* Previously it was possible to have certificate generation automatically create
10+
a subject `KeyPair` for you by leaving the `key_pair` field of
11+
`CertificateParams` empty, and retrieving the generated `KeyPair` from
12+
a `Certificate` created with the `CertificateParams` by calling
13+
`Certificate::get_key_pair()`.
14+
15+
To offer more consistency and to keep the `CertificateParams` and `Certificate`
16+
types from holding private key data, the new API requires you handle `KeyPair`
17+
creation yourself. See `CertifiedKey`, `KeyPair::generate()`,
18+
`KeyPair::generate_for()` and `KeyPair::generate_rsa_for()` for more information.
19+
20+
* Serializing a `Certificate`'s `KeyPair` to DER or PEM was previously done by
21+
calling `Certificate::serialize_private_key_der()` or
22+
`Certificate::serialize_private_key_pem()`. This is now handled by calling
23+
`KeyPair::serialize_der()` or `KeyPair::serialize_pem()`.
24+
25+
## Certificates
26+
27+
* For quick-and-easy self-signed certificate issuance,
28+
`generate_simple_self_signed` now returns a `CertifiedKey` in the success case
29+
instead of a `Certificate`. The self-signed `Certificate` can be accessed in
30+
the `cert` field of `CertifiedKey`, and the generated subject key pair in
31+
`key_pair`.
32+
33+
* Custom self-signed certificate issuance was previously done by
34+
constructing `CertificateParams` and calling `Certificate::from_params()` to
35+
create a `Certificate`. This is now done by calling
36+
`CertificateParams::self_signed()`, providing a subject `KeyPair` of your
37+
choosing.
38+
39+
* Custom certificate issuance signed by an issuer was previously done by
40+
constructing `CertificateParams`, calling `Certificate::from_params()` and
41+
then choosing the issuer at serialization time. This is now done ahead of
42+
serialization by calling `CertificateParams::signed_by()` and providing
43+
a subject `KeyPair` as well as an issuer `Certificate` and `KeyPair`.
44+
45+
* Previously certificate serialization was done by calling
46+
`Certificate::serialize_der()`, `Certificate::serialize_pem()`,
47+
`Certificate::serialize_der_with_signer()` or
48+
`Certificate::serialize_pem_with_signer()`. Each time a serialization fn was
49+
called a new certificate was issued, leading to confusion when it was desired
50+
to serialize the same certificate in two formats. In the new API issuance is
51+
handled by `CertificateParams` fns and the generated `Certificate` will not change
52+
when serialized. You can serialize it to PEM by calling `Certificate::pem()`,
53+
or access the DER encoding by calling `Certificate::der()`.
54+
55+
## Certificate Signing Requests (CSRs)
56+
57+
* Previously it was only possible to create a new CSR by first issuing
58+
a `Certificate` from `CertificateParams`, and calling
59+
`Certificate::serialize_request_pem()` or
60+
`Certificate::serialize_request_der()`. In the updated API you can create
61+
a `CertificateSigningRequest` directly from `CertificateParams` by calling
62+
`CertificateParams::serialize_request` and providing a subject `KeyPair`. You
63+
may serialize the CSR to DER or PEM by calling
64+
`CertificateSigningRequest::der()` or `CertificateSingingRequest::pem()`.
65+
66+
* To load a CSR from an existing PEM/DER copy with the old API required
67+
calling `CertificateSingingRequest::from_pem()` or
68+
`CertificateSigningRequest::from_der()`. The new API introduces
69+
a `CertificateSingingRequestParams` type that can be created using
70+
`CertificateSigningRequestParams::from_pem()` or
71+
`CertificateSingingRequest::from_der()`.
72+
73+
* To issue a certificate from an existing CSR with the old API required calling
74+
`CertificateSigningRequest::serialize_der_with_signer()` or
75+
`CertificateSigningRequest::serialize_pem_with_signer(). In the new API, call
76+
`CertificateSigningRequestParams::signed_by()` and provide an issuer
77+
`Certificate` and `KeyPair`.
78+
79+
## Certificate Revocation Lists (CRLs)
80+
81+
* Previously a `CertificateRevocationList` was created by calling
82+
`CertificateRevocationList::from_params()`. This is now done by calling
83+
`CertificateRevocationListParams::signed_by()` and providing an issuer
84+
`Certificate` and `KeyPair`.
85+
86+
* Previously a created `CertificateRevocationList` could be serialized to DER or
87+
PEM by calling `CertificateRevocationList::serialize_der_with_signer()` or
88+
`CertificateRevocationList::serialize_pem_with_signer()`. This is now done by
89+
calling `CertificateRevocationList::der()` or
90+
`CertificateRevocationList::pem()`.

0 commit comments

Comments
 (0)