# `x509-certificate` History
## Unreleased
Released on ReleaseDate.
## 0.24.0
Released on 2024-11-02.
* MSRV 1.65 -> 1.75.
* `bytes` 1.5 -> 1.8.
* `signature` 2.1 -> 2.2.
* `zeroize` 1.6 -> 1.8.
## 0.23.1
Released on 2023-11-16.
* `X509Certificate` now has a `tbs_certificate()` to retrieve a reference to
the raw, main certificate data structure.
* There are now `From<T>` implementations for `asn1time::Time`,
`asn1time::GeneralizedTime`, and `asn1time::UtcTime` that allow
conversion to `chrono::DateTime<chrono::Utc>`.
* `X509Certificate` now has `validity_not_before()` and `validity_not_after()`
methods to obtain a `chrono::DateTime<chrono::Utc>` corresponding to the
certificate's validity start and end times.
* `X509Certificate` now has a `time_constraints_valid()` to check whether the
time is between the validity constraints expressed in the certificate.
## 0.23.0
Released on 2023-11-07.
* `InMemorySigningKeyPair` now stores the private key as a
`Zeroize<Vec<u8>>` instead of a `Vec<u8>`.
* `InMemorySigningKeyPair` variants are now structs instead of
unnamed tuples.
* `InMemorySigningKeyPair` no longer implements
`From<ring::signature::Ed25519KeyPair>`.
* `InMemorySigningKeyPair` now has a `to_pkcs8_one_asymmetric_key_der()` method
to obtain this PKCS#8 DER representation of the key pair.
* `X509CertificateBuilder::create_with_random_keypair()` no longer returns
a `ring::pkcs8::Document`. (The PKCS#8 representation can now be obtained
from the returned `InMemorySigningKeyPair`.)
* `InMemorySigningKeyPair::generate_random()` no longer returns a
`ring::pkcs8::Document`. (The PKCS#8 representation can now be obtained
from the returned `InMemorySigningKeyPair`.)
* `X509CertificateBuilder::new()` no longer accepts a `KeyAlgorithm` argument.
* `X509CertificateBuilder` now implements `Default`. `new()` is deprecated
in favor of `default()`.
* `X509CertificateBuilder::create_with_random_keypair()` now requires a
`KeyAlgorithm` argument.
* `X509CertificateBuilder` has gained a `create_with_key_pair()` method that
allows creating a certificate with a caller specified key pair.
* `Sign::private_key_data()` now returns a `Zeroizing<Vec<u8>>` instead of a
`Vec<u8>`.
* `Sign::rsa_primes()` now returns `Zeroizing<Vec<u8>>` instead of `Vec<u8>`.
## 0.22.1
Released on 2023-11-05.
* `asn1time::UtcTime` now implements `From<chrono::DateTime<chrono::Utc>>`
to facilitate constructing instances from arbitrary times.
## 0.22.0
Released on 2023-11-03.
* `rfc5958::OneAsymmetricKey` (PKCS#8) decoding now correctly handles the
public key field. Before, it decoded the public key field as a constructed
value when it should have been a regular tagged value. This bug was masked
by a bug in ring <0.17, which generated PKCS#8 documents incorrectly. The
new decoder only recognizes valid encoded PKCS#8 documents. Please open an
issue if you would like support for decoding the invalid format restored.
* `pem` 2.0 -> 3.0.
* `ring` 0.16 -> 0.17.
## 0.21.0
Released on 2023-07-24.
* `GeneralizedTime` implements `From<chrono::DateTime<chrono::Utc>>` (#13).
## 0.20.0
Released on 2023-06-03.
* pem upgraded 1.1 -> 2.0.
* ``SignatureAlgorithm`` gained a ``NoSignature`` variant to express a
a digest without a signature. (#11)
* ``chrono`` compiled without default features (#12).
## 0.19.0
Released on 2023-03-19.
* `Time` now has a `take_opt_from()`.
* `rfc5280::Version` now has a `take_opt_from()`.
* `rfc5280::CertificateList` now has a `take_opt_from()`.
* `rfc5280::TbsCertList` now implements `take_from()`.
* der upgraded 0.6 -> 0.7.
* spki upgrades 0.6 -> 0.7.
* bytes upgraded 1.3 -> 1.4.
* Minimum Rust version 1.61 -> 1.65.
## 0.18.0
Released on 2023-01-21.
* signature upgraded 1.6 -> 2.0.
## 0.17.0
Released on 2022-12-30.
* pem upgraded 1.0 -> 1.1.
* signature upgraded 1.3 -> 1.6.
## 0.16.0
Released on 2022-12-19.
* Canonical home of project moved to https://github.com/indygreg/cryptography-rs.
* chrono crate upgraded from 0.4.22 to 0.4.23.
* Cargo.toml now defines patch versions of all dependencies.
## 0.15.0
(Released 2022-09-17)
* der crate upgraded from 0.5 to 0.6.
* spki crate upgraded from 0.5 to 0.6.
## 0.14.0
(Released 2022-08-07)
* bcder crate upgraded from 0.6.1 to 0.7.0. This entailed a lot of
changes, mainly to error handling.
## 0.13.0
* `X509Certificate` now implements the `spki::EncodePublicKey` trait.
This change marks the beginning of a shift/intent to converge this
crate onto the interfaces defined by crates under the
[RustCrypto](https://github.com/RustCrypto) umbrella for better
interop with the rest of the Rust ecosystem.
* `KeyAlgorithm` now implements conversion from/to `spki::ObjectIdentifier`.
* `InMemorySigningKeyPair` now implements `signature::Signer`. This
means there are now 2 implementations of `sign()` on this type. So
if both traits are in scope you will need to disambiguate the call.
* The `Sign::sign()` trait method is now marked as deprecated. Please
switch to the `signature::Signer` trait.
## 0.12.0
* Defined a new `Sign` trait to indicate support for cryptographic
signing. `InMemorySigningKeyPair` implements this trait and callers
may need to `use x509_certificate::Sign` to pull the trait into
scope.
* Some functions for resolving algorithm identifiers now return `Result`.
* Defined RFC 3447 ASN.1 types for representing RSA private keys.
* `InMemorySigningKeyPair` now holds the the raw private key data.
This enables the content to be retrieved later.
* Added certificate signing request ASN.1 types to the new `rfc2986` module.
* `X509CertificateBuilder` has a new
`create_certificate_signing_request()` method to create a
certificate signing request (CSR).
## 0.11.0
* Add some APIs on `Name` to retrieve additional well-known fields.
* Add `Name::user_friendly_str()` for obtaining a user-friendly string
from a series of attributes.
## 0.10.0
* `CapturedX509Certificate` has gained a
`verify_signed_data_with_algorithm()` method that uses an explicit
`ring::signature::VerificationAlgorithm` for verification. The new
method allows verifying when using an alternative verification
algorithm. `verify_signed_data()` now internally calls into the new
function.
## 0.9.0
* Store `version` field of `TbsCertificate` as `Option<Version>`
instead of `Version`. In 0.8.0 we interpreted a missing optional
field as version 1. This was semantically correct. However, when we
encoded the parsed data structure we would invent a new `version`
field where it didn't exist before. This mismatch is relevant for
operations like resolving the certificate fingerprint, as the extra
field would produce a different fingerprint result. Serializing now
omits the `version` field when it wasn't originally defined. (#525)
## 0.8.0
* Properly parse `TbsCertificate` that is missing a `version` field.
Before, we\'d get a `Malformed` error if this optional field was
missing. Now, we correctly interpret a missing field as version 1.
(#521)
## 0.7.0
* Refactor `GeneralizedTime` parsing to allow fractional seconds and
timezones. Previously, only limited forms of `GeneralizedTime` were
parsed. (#482)
## 0.6.0
* Support parsing `RSAPublicKey` from RFC 8017.
## 0.5.0 and Earlier
* No changelog kept.