Release v1.4.0 · astralmaster/AutoHttps

Fixes from a full audit of the certificate and ACME paths. Every change ships with unit, integration and Pebble (Docker) tests.

Core (AutoHttps 1.4.0)

Kestrel wiring: AutoHttps now preserves your own HTTPS defaults, the TLS options and any certificate selector, instead of dropping them, and fails at startup with a clear message when a later ConfigureHttpsDefaults call replaces its selector, rather than failing opaquely or serving the development certificate for a managed domain.
The self-signed fallback served before the first certificate arrives regenerates when it expires, instead of serving an expired certificate through a long outage.
A rate-limit Retry-After is capped at half the certificate's remaining validity, so a far-future value from a proxy or gateway cannot suspend renewal until the certificate expires.
The ACME directory is refetched when an endpoint it named answers 404 or stays unreachable, so an authority endpoint migration recovers without a restart.
The RFC 9773 replaces hint is sent only to authorities that advertise renewalInfo.
Renewal information is no longer queried for an already-expired certificate, and a finalize that reaches the authority before the order is ready is retried instead of abandoning the order.
Buypass is marked [Obsolete]: it ended its ACME service in 2025 and both directory URLs now return 404. Use Let's Encrypt, ZeroSSL or Google Trust Services.
Changing EmailAddress after the first run registers a new ACME account; this is now documented.

Key Vault options are validated at startup: VaultUri is required, and SecretPrefix must be letters, digits and hyphens and at most 30 characters, so a bad prefix fails with a message that names it instead of a raw SDK error the first time a certificate is written.

The other companion packages (Cloudflare, Route 53, Redis) are unchanged and stay at 1.0.0.