v4.34.0

• New DNS Plugins
  • Spaceship (#678)
  • GoDaddyV3 for use with new V3 API (#686)
  • MijnHost (#675) (Thanks @j81blog)
  • InfomaniakV2 (#689) (Thanks @Sundypha)
  • HostingNL (684) (Thanks @Tim81)
• Fixed Gandi API endpoint URL which recently changed. It is now a configurable parameter as well. (#682)
• Fixed Regru compatibility with API 2 (#687) (Thanks @kropachev)
• Fixed a number of GCloud issues:
  • Now works against accounts with many zones (#688)
  • Fixed future dns-persist-01 support
  • GCProjectId may now be a comma-delimited string (or string array as before)
  • Better error handling

v4.33.1

• Fixed parameter validation errors on renewal due to DnsVariant parameter being empty (#679)

v4.33.0

• Added preliminary support for dns-account-01 challenge type based on draft-ietf-acme-dns-account-label-03.
  • New -DnsVariant parameter in various Order and Challenge related functions.
  • New Get-DnsAcctLabel utility function
• New -UsePfxDerEncoding to New-PACertificate, New-PAOrder, and Set-PAOrder which changes the encoding within generated PFX files from BER to DER. This may be necessary for compatibility with some applications, libraries, or services that have deprecated BER support. (#674)
• New HostUp plugin (#663) (Thanks @itssimple)
• Cloudflare: Fixed a bug with TXT records containing quotes and did some light refactoring
• GoDaddy: Added support for corporate (Brandsight) API access which requires a Customer ID value. (#660) (Thanks @vertras)
• GoDaddy: Fixed support for TXT records containing quotes
• Namecheap: Reduced required API permissions for delegated corporate accounts to just domains.dns.* (#672)
• Namecheap: Added Sandbox support and better debug logging
• Namecheap: Fixed TXT records containing quotes and apex record support
• AutoDNS: Fixed string formatting error when using a password containing curly braces (#671)
• Fixed a PowerShell 5.1 specific bug in Publish-DnsPersistChallenge and Unpublish-DnsPersistChallenge
• Disabled PowerShell native debug logging on low level ACME calls which is now way more verbose in 7.6 and was duplicating the module specific logging.

v4.32.0

• New DNSExit plugin (#668) (Thanks @joxdev13)
• Preliminary support for dns-persist-01
  • Adds functions Publish-DnsPersistChallenge and Unpublish-DnsPersistChallenge. These are subject to change while the spec is still in a draft state.
  • I wanted to get these released early so folks can start testing the DNS plugins with them. No other core module changes have been added to support the cert workflow for this challenge type yet.
  • It is highly recommended to test these functions using your preferred DNS plugin. I suspect there are some bugs in some of the plugins that might surface because they have only been tested creating ACME challenge TXT records until now. Please submit issues for plugins that have problems.
• Fixed bug in Infoblox plugin that caused errors when TxtValue required URL escaping
• Added better error handling in Get-PAPluginArgs when decrypting encrypted args fails (#654)

Potentially Breaking Change

• Generated CSRs no longer include the Enhanced Key Usage (EKU) extension.
  • This is a fix for CAs that have started rejecting CSRs containing the Client Authentication EKU such as Google due to its deprecation across all public CAs.
  • This change has been tested successfully against all known free public ACME CAs. The resulting certs still contain the EKU extension, but which EKUs get added is dependent on the CA as it has always been.
  • However, there are many commercial and private CAs I was unable to test against which is why this might be a breaking change for them. PLEASE test if you're not using one of the free public ACME CAs.
  • If for some reason your preferred CA rejects the new CSRs, you may always fall back to supplying your own CSR using the -CSRPath param in many of the functions.

v4.31.1

• Fixed bug in CSR generation for IP address certs. IPs will no longer be added to CSR Common Name. If an IP address is the "MainDomain" of the order, the CSR CN will be empty. (#658)

v4.31.0

• New Technitium DNS plugin. (#653) (Thanks @shalafi99)
• Added CSR property to the output of Get-PACertificate which is the path to the CSR file used for the request. (#650) (Thanks @skyblaster)
• Fixed bug in HetznerCloud plugin due to duplicate ErrorAction param use (#656)

v4.30.1

• Fixed Simply and SimplyCom plugins which now require trailing slashes to API endpoints. (#646) (Thanks @tomsommer)

v4.30.0

• New HetznerCloud plugin (#642) (Thanks @humnose)
  • This is for Hetzner users who have migrated their zones from the legacy "DNS Console" to the new "Hetzner Console". NOTE: New API tokens are needed.
• Added AZArcAgentAPIVersion param for Azure IMDS parameter set (#636) (Thanks @semics-tech)
  • This may be necessary systems running older versions of the Azure Managed Identity Agent that don't work with the default version identifier.
• Added ACTALIS_PROD to the list of well-known directory shortcuts. They've also been added to the ACME CA Comparison guide.
• Removed BUYPASS_PROD and BUYPASS_TEST from the list of well-known directory shortcuts since they are no longer in operation.
• Removed a workaround for a BuyPass server bug which is no longer necessary.
• Fixed Windows plugin breaks when not using WinUseSsl or WinSkipCACheck switches (#637) (Thanks @jmpederson1)
• Fixed PS 5.1 compat with DeSEC and EuroDNSReseller by removing -Depth param from ConvertFrom-Json calls (#643)
• Fixed null ref errors in CoreNetworks plugin when no matching zone found. Added additional debug logs. (#616)

v4.29.3

• The current ACME server directory endpoint is now refreshed on module import to ensure server changes are reflected before actions are performed. If the previously used ACME server is unreachable, a warning is thrown and previously cached data is used.
  • This should fix anyone who is getting 404 errors when renewing Let's Encrypt certs due to an unannounced change to their ARI endpoint. Users can also fix this problem without upgrading by running Get-PAServer -Refresh.

v4.29.2

• Fixed param set resolution error with New-PACertificate when using CSRPath/CSRString params (#629)
• Added workaround for non-compliant order response from KeyFactor ACME provider (#626)
• Added additional logging to DuckDNS plugin (#628)
• Tweaked debug output for ACME responses for better human readability