v4.1.0

Added

• IP address identifiers (RFC 8738): IdentifierType.Ip, and NewOrder,
  NewOrderWithProfile and NewReplacementOrder overloads accepting typed
  Identifier lists. IP values are validated and sent in canonical form.
• Certificate profile discovery through DirectoryMeta.Profiles, selection via
  NewOrderWithProfile, and the selected Order.Profile
  (#330). Profile orders can also
  include an ARI replacement certificate ID.
• ACME Renewal Information (ARI, RFC 9773): Directory.RenewalInfo,
  GetRenewalInfoCertificateId() for CertificateChain and IEncodable,
  GetRenewalInfo() (suggested window, explanation URL and Retry-After) and
  NewReplacementOrder() extension methods on IAcmeContext, and Order.Replaces.
  Based on the proposal in #329
  by @WhitWaldo.
• CLI: order new --profile and --replaces, cert renewal-info <cert-path>,
  and the tls-alpn challenge type for order authz/order validate (with
  dns-01, http-01 and tls-alpn-01 aliases). IP addresses passed to
  order new are ordered as IP identifiers.

Changed

• NewOrder, NewOrderWithProfile and NewReplacementOrder string overloads
  now send values that strictly parse as IP addresses as ip identifiers in
  canonical form, instead of dns. CAs reject IP addresses as DNS identifiers, so
  previously such orders always failed.
• IOrderContext.Authorization(value, IdentifierType.Ip) compares IP identifiers
  by address rather than by text.
• CertificationRequestBuilder encodes subject alternative names that are IP
  addresses as IP SANs instead of DNS names, and TlsAlpnCertificate does the same
  for its subject name.
• When CsrInfo.CommonName is not set, Finalize/Generate use the first DNS
  name of at most 64 characters as the common name, instead of always the first
  identifier. IP-only orders produce a CSR without a common name.

Fixed

• CLI: cert pfx --help described the command as exporting PEM.

Full changelog: https://github.com/fszlin/certes/blob/v4.1.0/docs/CHANGELOG.md