diff options
author | Florian Klink <flokli@flokli.de> | 2020-02-10 11:47:30 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2020-02-10 11:47:30 +0100 |
commit | 4e0fea3fe294d112ac6eef5adbed2357b295f11d (patch) | |
tree | 45b53b3094ef53b294dded1ad97f91d92ff0feb7 /nixos/doc | |
parent | b2abf364677d3cfc360dbe8cef44cd5ff15c383c (diff) | |
parent | 75fa8027ebbfaa31e67bf2e931b8b3d428494692 (diff) |
Merge pull request #77578 from m1cr0man/master
Replace simp-le with lego and support DNS-01 challenge
Diffstat (limited to 'nixos/doc')
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2003.xml | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml index d7614cd3488c..eac50b705a88 100644 --- a/nixos/doc/manual/release-notes/rl-2003.xml +++ b/nixos/doc/manual/release-notes/rl-2003.xml @@ -661,6 +661,21 @@ auth required pam_succeed_if.so uid >= 1000 quiet now uses the short rather than full version string. </para> </listitem> + <listitem> + <para> + The ACME module has switched from simp-le to <link xlink:href="https://github.com/go-acme/lego">lego</link> + which allows us to support DNS-01 challenges and wildcard certificates. The following options have been added: + <link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link>, + <link linkend="opt-security.acme.certs">security.acme.certs.<name>.dnsProvider</link>, + <link linkend="opt-security.acme.certs">security.acme.certs.<name>.credentialsFile</link>, + <link linkend="opt-security.acme.certs">security.acme.certs.<name>.dnsPropagationCheck</link>. + As well as this, the options <literal>security.acme.acceptTerms</literal> and either + <literal>security.acme.email</literal> or <literal>security.acme.certs.<name>.email</literal> + must be set in order to use the ACME module. + Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are + preserved and thus it is possible to roll back to previous versions without breaking certificate + generation. + </listitem> <listitem> <para> It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token |