v4.0.0

Breaking changes

• PFX export now encrypts the private key and certificates with AES-256-CBC
  (PBES2, PBKDF2 with HMAC-SHA256) instead of 3DES and 40-bit RC2. OpenSSL 3 and
  Android reject the old algorithms, so PFX files from earlier versions failed to
  load there without OpenSSL's legacy provider. Windows Server 2016 and earlier
  cannot read AES-encrypted PFX files; set PfxBuilder.Encryption to
  PfxEncryption.Legacy, or pass --legacy-encryption to certes cert pfx, to
  keep the old algorithms. The PFX integrity check remains HMAC-SHA1 with 1024
  iterations, because BouncyCastle does not expose other settings.

Fixed

• IOrderContextExtensions.Generate now waits for an order to become ready
  before sending finalize. Previously it could finalize while the order was still
  pending, which ACME servers reject. The retryCount budget remains shared
  between this pre-finalize wait and post-finalize polling of pending/
  processing. If challenge validation was never triggered, this can wait up to
  60 server-directed Retry-After intervals by default.

Changed

• CertificateChainExtensions.ToPem now always emits LF (\n) line endings,
  avoiding mixed \r\n/\n output across platforms.

Full changelog: https://github.com/fszlin/certes/blob/v4.0.0/docs/CHANGELOG.md