Headlines

• More powerful certificate revocation list (CRL) support. There is now an API for explicitly configuring whether CRLs are mandatory or optional, and which parts of the certificate chain they apply to.
• Extensible and observable path building. This crate now returns an example of a found certificate path, and optionally allows callers to reject valid paths to continue the search.
• Improving API stability. This crate now uses types from rustls-pki-types; we expect this to reduce the number of breaking changes in rustls ecosystem.
• Pluggable crypto providers. This crate can now depend on signature verification algorithms provided externally. ring is now an optional (but default) dependency, and aws-lc-rs is a new optional dependency.

What's Changed

• cert: retain CRL distribution points extension. by @cpu in #127
• Tweak style in distribution point handling by @djc in #137
• crl: retain issuing distribution point extension by @cpu in #128
• Implement FromDer trait and DerIterator type by @djc in #139
• Make ring optional by @ctz in #134
• Name iterator by @djc in #140
• Impl FromDer for more types by @djc in #141
• fix no-std support by @japaric in #145
• Refactor DER parsing by @djc in #142
• revocation: more sophisticated revocation checking. by @cpu in #138
• build(deps): bump cryptography from 41.0.2 to 41.0.3 by @dependabot in #146
• Use doc_auto_cfg and remove manual doc(cfg()) gates by @ctz in #150
• bettertls: test both pathbuilding and nameconstraints. by @cpu in #151
• verify_cert: enforce maximum number of signatures. by @cpu in #152
• Fix build & clippy lints by @ctz in #156
• SECURITY.md: use github vuln reporting tool by @ctz in #155
• Enable warnings for cargo doc comments on private items by @cpu in #157
• Switch to using the pki-types crate by @djc in #147
• Bump version to alpha.1 with pki-types by @djc in #161
• build(deps): bump actions/checkout from 3 to 4 by @dependabot in #162
• Further limits on expensive path building by @ctz in #163
• Budget tweaks by @djc in #164
• Use signature verification trait from pki-types by @ctz in #166
• verify_cert: bound name constraint comparisons. by @cpu in #165
• Remove subject common name parsing by @hawkw in #169
• verify_cert: correct handling of fatal errors. by @cpu in #168
• subject_name: fix stale unused_imports allow. by @cpu in #171
• Extract PathNode from Cert by @djc in #173
• Use pki_types::UnixTime instead of local Time type by @djc in #175
• tests: local test speed optimizations, add cargo hack feature powerset by @cpu in #176
• docs: add CONTRIBUTING.md, ref'ing Rustls CONTRIBUTING by @cpu in #177
• Note that self-signed certificates are not supported. by @bdaehlie in #180
• properly test build chain call budget by @cpu in #179
• Use stable for coverage measurement by @ctz in #181
• Optionally support aws-lc-rs by @ctz in #158
• rework dns_names helper, remove alloc req. by @cpu in #178
• Let EndEntityCert deref to Cert by @djc in #184
• Refactor name verification flow by @djc in #188
• Cargo: remove rcgen git patch by @cpu in #189
• crl: rm Budget from verify_signature fn by @cpu in #190
• NFC: Correct name of mozilla::pkix in comment. by @cpu in #192
• Cargo: restore rcgen w/ no-default-features by @cpu in #195
• Upgrade to untrusted 0.9 and ring 0.17 by @djc in #193
• Prepare 0.102.0-alpha.4 by @ctz in #194
• build(deps): bump cryptography from 41.0.3 to 41.0.4 by @dependabot in #196
• Expose built path in public API by @djc in #174
• verify_cert: add test for rejecting candidate path by @cpu in #197
• Deny warnings from clippy by @djc in #198
• Use cargo-check-external-types to control type leakage in public API by @cpu in #202
• trust_anchor: fix stale note about EndEntityOrCA by @cpu in #204
• Improve CRL ergonomics, replace trait with enum by @cpu in #203
• trust_anchor: clarify and rename extract_trust_anchor by @cpu in #201
• Remove unused git exception from deny config by @djc in #208
• Migrate to pki-types ServerName by @djc in #207
• verify_cert: re-export VerifiedPath by @BiagioFesta in #210
• derive Debug for RingAlgorithm, AwsLcRsAlgorithm by @cpu in #212

New Contributors

• @japaric made their first contribution in #145
• @hawkw made their first contribution in #169
• @bdaehlie made their first contribution in #180
• @BiagioFesta made their first contribution in #210

Full Changelog: v/0.101.7...v/0.102.0