Repository navigation
Close idle connections on client certificate renew - #2515
Merged
Merged
Conversation
This commit changes the ca client that returns a "tls.Config" to close connections sitting idle in a keep-alive state. This forces new client connections to use the new certificate.
github-actions
Bot
added
the
needs triage
hslatman
approved these changes
Jan 6, 2026
liujed
pushed a commit
to liujed/caddy-dns01proxy
that referenced
this pull request
Mar 29, 2026
Bumps [github.com/smallstep/certificates](https://github.com/smallstep/certificates) from 0.30.0-rc3 to 0.30.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/smallstep/certificates/releases">github.com/smallstep/certificates's releases</a>.</em></p> <blockquote> <h2>Step CA v0.30.2 (26-03-23)</h2> <h2>Official Release Artifacts</h2> <h4>Linux</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_linux_0.30.2_amd64.tar.gz">step-ca_linux_0.30.2_amd64.tar.gz</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_0.30.2-1_amd64.deb">step-ca_0.30.2-1_amd64.deb</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca-0.30.2-1.x86_64.rpm">step-ca-0.30.2-1.x86_64.rpm</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_0.30.2-1_arm64.deb">step-ca_0.30.2-1_arm64.deb</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca-0.30.2-1.aarch64.rpm">step-ca-0.30.2-1.aarch64.rpm</a></li> </ul> <h4>OSX Darwin</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_darwin_0.30.2_amd64.tar.gz">step-ca_darwin_0.30.2_amd64.tar.gz</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_darwin_0.30.2_arm64.tar.gz">step-ca_darwin_0.30.2_arm64.tar.gz</a></li> </ul> <h4>Windows</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_windows_0.30.2_amd64.zip">step-ca_windows_0.30.2_amd64.zip</a></li> </ul> <p>For more builds across platforms and architectures, see the <code>Assets</code> section below. And for packaged versions (Docker, k8s, Homebrew), see our <a href="https://smallstep.com/docs/step-ca/installation">installation docs</a>.</p> <p>Don't see the artifact you need? Open an issue <a href="https://github.com/smallstep/certificates/issues/new/choose">here</a>.</p> <h2>Signatures and Checksums</h2> <p><code>step-ca</code> uses <a href="https://github.com/sigstore/cosign">sigstore/cosign</a> for signing and verifying release artifacts.</p> <p>Below is an example using <code>cosign</code> to verify a release artifact:</p> <pre><code>cosign verify-blob \ --bundle step-ca_darwin_0.30.2_amd64.tar.gz.sigstore.json \ --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ step-ca_darwin_0.30.2_amd64.tar.gz </code></pre> <p>The <code>checksums.txt</code> file (in the <code>Assets</code> section below) contains a checksum for every artifact in the release.</p> <h2>Changelog</h2> <ul> <li>6e8ec61405239cf3f37b2bbf260a587b7d2e4e31 Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2606">#2606</a> from smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3</li> <li>90b84cdf15ca2f998129c859e227f3b0fcd7d732 Bump google.golang.org/grpc from 1.79.2 to 1.79.3</li> </ul> <h2>Thanks!</h2> <p>Those were the changes on v0.30.2!</p> <p>Come join us on <a href="https://discord.gg/X2RKGwEbV9">Discord</a> to ask questions, chat about PKI, or get a sneak peek at the freshest PKI memes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/smallstep/certificates/blob/master/CHANGELOG.md">github.com/smallstep/certificates's changelog</a>.</em></p> <blockquote> <h2>[0.30.2] - 2026-03-22</h2> <ul> <li>Update golang.org/grpc to patch security advisory</li> </ul> <h3>[0.30.1] - 2026-03-18</h3> <ul> <li>Fix release issue</li> </ul> <h3>[0.30.0] - 2026-03-18</h3> <h3>Added</h3> <ul> <li><code>smallstep/certificates#2526</code></li> <li><code>smallstep/certificates#2570</code></li> <li><code>smallstep/certificates#2533</code></li> </ul> <h3>Changed</h3> <ul> <li>Upgrade HSM-enabled Docker images from Debian Bookworm (12) to Debian Trixie <code>smallstep/certificates#2493</code></li> <li>Use JSON array format for Dockerfile's <code>CMD</code> instruction. This prevents shell interpolation of environment variables like <code>CONFIGPATH</code> and <code>PWDPATH</code>, ensuring consistent command execution. Commands can still be overridden via <code>smallstep/certificates#2493</code></li> </ul> <h3>Fixed</h3> <ul> <li>Fix CRL IssuingDistributionPoint marshaling to correctly unset <code>OnlyContainsUserCerts</code> and <code>OnlyContainsCACerts</code><code>smallstep/certificates#2511</code></li> <li>Fix CRL DER download content-disposition filename extension from <code>.der</code> to <code>.crl</code><code>smallstep/certificates#2537</code></li> <li><code>smallstep/certificates#2379</code></li> <li><code>smallstep/certificates#1893</code></li> <li><code>smallstep/certificates#2513</code></li> <li><code>smallstep/certificates#2569</code></li> <li><code>smallstep/certificates#2517</code></li> <li><code>smallstep/certificates#2515</code></li> </ul> <h2>[0.29.0] - 2025-12-03</h2> <h3>Added</h3> <ul> <li><code>smallstep/certificates#2370</code></li> <li><code>smallstep/certificates#2382</code></li> <li><code>smallstep/certificates#2408</code></li> <li><code>smallstep/certificates#2461</code></li> <li><code>smallstep/certificates#2463</code></li> </ul> <h3>Changed</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/smallstep/certificates/commit/6e8ec61405239cf3f37b2bbf260a587b7d2e4e31"><code>6e8ec61</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2606">#2606</a> from smallstep/dependabot/go_modules/google.golang.o...</li> <li><a href="https://github.com/smallstep/certificates/commit/90b84cdf15ca2f998129c859e227f3b0fcd7d732"><code>90b84cd</code></a> Bump google.golang.org/grpc from 1.79.2 to 1.79.3</li> <li><a href="https://github.com/smallstep/certificates/commit/10c9392c3f90b1738eadb31db32501dd4ae91e0f"><code>10c9392</code></a> Changelog update v0.30.1 (<a href="https://redirect.github.com/smallstep/certificates/issues/2605">#2605</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0"><code>d34619c</code></a> Update CHANGELOG for 0.30.0 (<a href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/cfcbe4c2f93ec7e7f0347b4d0190353946189be7"><code>cfcbe4c</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a> from smallstep/mariano/scep-type-check</li> <li><a href="https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef"><code>e6da031</code></a> Add scep integration tests</li> <li><a href="https://github.com/smallstep/certificates/commit/d4103d6626a6b1e95223610b7fc46757aaa255b8"><code>d4103d6</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a> from savely-krasovsky/master</li> <li><a href="https://github.com/smallstep/certificates/commit/07e4424836212198eaabed92517a98e0ec993175"><code>07e4424</code></a> Add revocation reason code to CRL | replace deprecated pkix.RevokeCertificate</li> <li><a href="https://github.com/smallstep/certificates/commit/3ce51133ce4aa786796e6cbff04ead25e7ac8c6b"><code>3ce5113</code></a> Bump nosql and crypto (<a href="https://redirect.github.com/smallstep/certificates/issues/2600">#2600</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/927ecc7bafcafac228b337d7acf2113491edec01"><code>927ecc7</code></a> Add actions and security-events permissions to release CI job (<a href="https://redirect.github.com/smallstep/certificates/issues/2593">#2593</a>)</li> <li>Additional commits viewable in <a href="https://github.com/smallstep/certificates/compare/v0.30.0-rc3...v0.30.2">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions Bot
pushed a commit
to CruGlobal/mirage-server
that referenced
this pull request
Jul 31, 2026
…0.0 (#26) Bumps [github.com/smallstep/certificates](https://github.com/smallstep/certificates) from 0.28.4 to 0.30.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/smallstep/certificates/releases">github.com/smallstep/certificates's releases</a>.</em></p> <blockquote> <h2>Release v0.30.0</h2> <p>No release notes provided.</p> <h2>Step CA v0.30.0-rc7 (26-03-18)</h2> <h2>Official Release Artifacts</h2> <h4>Linux</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_linux_0.30.0-rc7_amd64.tar.gz">step-ca_linux_0.30.0-rc7_amd64.tar.gz</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_0.30.0.rc7-1_amd64.deb">step-ca_0.30.0.rc7-1_amd64.deb</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca-0.30.0.rc7-1.x86_64.rpm">step-ca-0.30.0.rc7-1.x86_64.rpm</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_0.30.0.rc7-1_arm64.deb">step-ca_0.30.0.rc7-1_arm64.deb</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca-0.30.0.rc7-1.aarch64.rpm">step-ca-0.30.0.rc7-1.aarch64.rpm</a></li> </ul> <h4>OSX Darwin</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_darwin_0.30.0-rc7_amd64.tar.gz">step-ca_darwin_0.30.0-rc7_amd64.tar.gz</a></li> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_darwin_0.30.0-rc7_arm64.tar.gz">step-ca_darwin_0.30.0-rc7_arm64.tar.gz</a></li> </ul> <h4>Windows</h4> <ul> <li>📦 <a href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_windows_0.30.0-rc7_amd64.zip">step-ca_windows_0.30.0-rc7_amd64.zip</a></li> </ul> <p>For more builds across platforms and architectures, see the <code>Assets</code> section below. And for packaged versions (Docker, k8s, Homebrew), see our <a href="https://smallstep.com/docs/step-ca/installation">installation docs</a>.</p> <p>Don't see the artifact you need? Open an issue <a href="https://github.com/smallstep/certificates/issues/new/choose">here</a>.</p> <h2>Signatures and Checksums</h2> <p><code>step-ca</code> uses <a href="https://github.com/sigstore/cosign">sigstore/cosign</a> for signing and verifying release artifacts.</p> <p>Below is an example using <code>cosign</code> to verify a release artifact:</p> <pre><code>cosign verify-blob \ --bundle step-ca_darwin_0.30.0-rc7_amd64.tar.gz.sigstore.json \ --certificate-identity-regexp "https://github\.com/smallstep/workflows/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ step-ca_darwin_0.30.0-rc7_amd64.tar.gz </code></pre> <p>The <code>checksums.txt</code> file (in the <code>Assets</code> section below) contains a checksum for every artifact in the release.</p> <h2>Changelog</h2> <ul> <li>d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0 Update CHANGELOG for 0.30.0 (<a href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li> <li>cfcbe4c2f93ec7e7f0347b4d0190353946189be7 Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a> from smallstep/mariano/scep-type-check</li> <li>e6da031d5125cfd99fe9a26f74bb41e4dacca4ef Add scep integration tests</li> <li>d4103d6626a6b1e95223610b7fc46757aaa255b8 Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a> from savely-krasovsky/master</li> <li>07e4424836212198eaabed92517a98e0ec993175 Add revocation reason code to CRL | replace deprecated pkix.RevokeCertificate</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/smallstep/certificates/blob/master/CHANGELOG.md">github.com/smallstep/certificates's changelog</a>.</em></p> <blockquote> <h3>[0.30.0] - 2026-03-18</h3> <h3>Added</h3> <ul> <li><code>smallstep/certificates#2526</code></li> <li><code>smallstep/certificates#2570</code></li> <li><code>smallstep/certificates#2533</code></li> </ul> <h3>Changed</h3> <ul> <li>Upgrade HSM-enabled Docker images from Debian Bookworm (12) to Debian Trixie <code>smallstep/certificates#2493</code></li> <li>Use JSON array format for Dockerfile's <code>CMD</code> instruction. This prevents shell interpolation of environment variables like <code>CONFIGPATH</code> and <code>PWDPATH</code>, ensuring consistent command execution. Commands can still be overridden via <code>smallstep/certificates#2493</code></li> </ul> <h3>Fixed</h3> <ul> <li>Fix CRL IssuingDistributionPoint marshaling to correctly unset <code>OnlyContainsUserCerts</code> and <code>OnlyContainsCACerts</code><code>smallstep/certificates#2511</code></li> <li>Fix CRL DER download content-disposition filename extension from <code>.der</code> to <code>.crl</code><code>smallstep/certificates#2537</code></li> <li><code>smallstep/certificates#2379</code></li> <li><code>smallstep/certificates#1893</code></li> <li><code>smallstep/certificates#2513</code></li> <li><code>smallstep/certificates#2569</code></li> <li><code>smallstep/certificates#2517</code></li> <li><code>smallstep/certificates#2515</code></li> </ul> <h2>[0.29.0] - 2025-12-03</h2> <h3>Added</h3> <ul> <li><code>smallstep/certificates#2370</code></li> <li><code>smallstep/certificates#2382</code></li> <li><code>smallstep/certificates#2408</code></li> <li><code>smallstep/certificates#2461</code></li> <li><code>smallstep/certificates#2463</code></li> </ul> <h3>Changed</h3> <ul> <li><code>smallstep/certificates#2343</code></li> </ul> <h3>Fixed</h3> <ul> <li><code>smallstep/certificates#2338</code></li> <li><code>smallstep/certificates#2435</code></li> <li><code>smallstep/certificates#2444</code></li> </ul> <h3>Security</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/smallstep/certificates/commit/d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0"><code>d34619c</code></a> Update CHANGELOG for 0.30.0 (<a href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/cfcbe4c2f93ec7e7f0347b4d0190353946189be7"><code>cfcbe4c</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a> from smallstep/mariano/scep-type-check</li> <li><a href="https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef"><code>e6da031</code></a> Add scep integration tests</li> <li><a href="https://github.com/smallstep/certificates/commit/d4103d6626a6b1e95223610b7fc46757aaa255b8"><code>d4103d6</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a> from savely-krasovsky/master</li> <li><a href="https://github.com/smallstep/certificates/commit/07e4424836212198eaabed92517a98e0ec993175"><code>07e4424</code></a> Add revocation reason code to CRL | replace deprecated pkix.RevokeCertificate</li> <li><a href="https://github.com/smallstep/certificates/commit/3ce51133ce4aa786796e6cbff04ead25e7ac8c6b"><code>3ce5113</code></a> Bump nosql and crypto (<a href="https://redirect.github.com/smallstep/certificates/issues/2600">#2600</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/927ecc7bafcafac228b337d7acf2113491edec01"><code>927ecc7</code></a> Add actions and security-events permissions to release CI job (<a href="https://redirect.github.com/smallstep/certificates/issues/2593">#2593</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/c14008e5ad73d2b920411deabcd07b14f9828165"><code>c14008e</code></a> Fix the test for CRL disposition (<a href="https://redirect.github.com/smallstep/certificates/issues/2599">#2599</a>)</li> <li><a href="https://github.com/smallstep/certificates/commit/10cd5c20c510c14dd4e6a4a3a68a2e7e69cc7489"><code>10cd5c2</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2537">#2537</a> from filimonic/crl-fix-crl-file-extension</li> <li><a href="https://github.com/smallstep/certificates/commit/6f1a2286f3bcd67729acbce8ffba75db30efed25"><code>6f1a228</code></a> Merge pull request <a href="https://redirect.github.com/smallstep/certificates/issues/2594">#2594</a> from smallstep/dependabot/go_modules/github.com/goog...</li> <li>Additional commits viewable in <a href="https://github.com/smallstep/certificates/compare/v0.28.4...v0.30.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/CruGlobal/mirage-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit changes the ca client that returns a "tls.Config" to close connections sitting idle in a keep-alive state. This forces new client connections to use the new certificate.