NOTE: Please look to the technical section of the smallstep blog for all release notes for step cli and certificates.
The format is based on Keep a Changelog and this project adheres to Semantic Versioning.
- Add Solus OS support to truststore when used in
step ca bootstrap --install
. - Add
step completion
command to print the shell completion script.
- IPv6 addresses are normalized as IP addresses internally.
- When the
--context
flag is provided when initializing a CA, configuration and other files will be stored in a directory named after the value provided instead of being named after the first DNS name.
- IP SAN support when using
step ca sign
and an ACME provisioner (see 819). - Offline mode no longer requires
--ca-url
to be set. - Add missing
TemplateData
when signing x509 certificates in offline mode. - Improved
needs-renewal
example help texts. - Improved
step crl inspect
reason output.
- Add additional
emoji
andbase64-raw
encoding to the--format
flag ofstep certificate fingerprint
. - Add
--format
flag tostep crypto key fingerprint
. - Add
--format
flag tostep ssh fingerprint
. - Add FreeBSD support to
step certificate install
. - Add
step crl inspect
to inspect a certificate revocation list (CRL). - Add
--auth-param
flag tostep oauth
for adding args to query. - Add
--no-agent
flag tostep ssh certificate
to skip ssh-add. - Add IP SANs support to
step ca certificate
when using an ACME provisioner. - Add support for adding and updating Nebula provisioners.
- Allow
step ssh login
andstep ssh logout
without positional arguments. - Additional configuration options for SCEP provisioners.
- Ability to use multiple certificate authority contexts without the need to change $STEPPATH.
- Support for go 1.15
- gocritic linter
- Allow to initialize step-ca config with Azure Key Vault using
step ca init --kms azurekms
.
- gocritic warnings
- Allow override of the listen address on OIDC flows when there is an existing value in provisioner configuration.
- Add a way to set the redirect_uri in an OIDC flow. Allowing to get a certificate from containers or environments where it is hard to send traffic to 127.0.0.1 and where the IDP does not support the urn:ietf:wg:oauth:2.0:oob flow.
- Bug in step ssh certificate --offline where password-file flag was always set to the value of provisioner-password-file flag.
- exit code '2' for file not exists scenarios in 'needs-renewal' commands
- go 1.17 to github action test matrix
- non interactive provisioner password file flag in
step ca token --offline
- Using go 1.17 to build
- Have
--dns
behave as string slice flag instep ca init
- The way CSR is created on
step ca certificate
with OIDC to better support of admins
- Fix
make bootstrap
failing to get GOPATH and installgolangci-lint
. - ipv6 address error in multi-DNS csv
step ca init
- Use cosign to sign and upload signatures for multi-arch Docker container.
- Debian checksum
- Sign over goreleaser github artifacts using cosign
--bundle
flag to cert/inspect for inpecting all the full chain or bundle given a path. Default behavior is unchanged; only inspect the first (leaf) certificate.- distribution.md with documentation on how to create releases.
- travis build and upload artifacts to Github Releases on tagged pushes.
- logging of invalid http requests to the oauth server
- default PEM format encryption alg AES128 -> AES256
- Initial version of
step