sewer

0.8.2 release

0.8.2 contains a lot more work - and changes - than recent releases, hence this verbose guide to what’s been going on in sewer this spring.

To my mind, the big change has been landing the revised RFC protocol changes. This allows sewer to operate against LE’s staging server again, and to continue to work with their production server when they drop compatibility with the earlier version of the protocol in November.

Other changes that may be equally important to some users have been the addition of drivers for the powerdns and gandi DNS services, and changes to accomodate http-01 challenge providers. The interface for dns-01 and http-01 challenge providers has been unified from its initial form, and hopefully that interface is general enough to accomodate not only dns-01 and http-01, but other future challenge types.

bugs, fixed or known

There are two related issues with wildcard certificates that have turned up in some providers. The first of these was fixed in 0.8.1, when we stopped Client from prefixing wildcard names with “*.” when passing them to the providers. That issue has been known for a long time, and some providers already had a workaround - but sometimes the workaround wasn’t complete (PR #139, eg.).

The second issue arises only when requesting a wildcard certificate (for *.domain.tld, say) that is to also cover the naked domain (domain.tld). This arises when the DNS service has issues with setting up two TXT records for the two separate challenges ACME needs, because they both are on domain.tld. There doesn’t seem to be any easy global fix for this, as there was for the first problem, so it’s being fixed provider by provider as it arises (and there’s a user of that service to help with the fix).

other changes

The cli program has, I believe, no user-visible incompatibilties.