Changelog:
-
Support for IP Identifiers
Notice: Existing installations might have to modify the database schema! Following is an example for mysql/mariadb:ALTER TABLE `identifier` MODIFY COLUMN `type` ENUM('dns','ip') DEFAULT NULL; -
EJBCA Backend: Support issuing certificates from a different intermediate CA depending on the public key algorithm used in the CSR
This is meant so RSA leaf certificates can be signed by an RSA intermediate, and ECDSA leaf certificates by an ECDSA intermediate.Serles will now actively filter non-RSA, non-ECDSA public keys. If you previously issued legacy DSA certificates or ED25519 certs, these will not work any longer. Neither of these certificates are allowed for publicly trusted TLS certificates, so the impact should be limited.
-
Support trimming the self-signed root certificate from the returned chain
This is sometimes useful to reduce the size of the SERVER_HELLO TLS message.