feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

2026-10-25 22:05:39 +01:00
1 parent fe45272f7c
commit 8d3469d10a
@@ -1,3 +1,42 @@
+vpn-router (0.21.0-1) unstable; urgency=medium
+
+  feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.
+
+  * The root CA signs the issuing CAs p2s, which issues the router's VPN
+    server certificate and the users' certificates, s2s, which issues
+    the site-to-site certificates, and the general-purpose CAs of
+    pki.issuing_cas; road-warrior and OpenVPN accept certificates of p2s
+    only.
+  * The pki section of vpn-router.json sets the names, lifetimes and
+    key type of the CAs, the validity of the CRLs, where certificates
+    and CRLs are published, the general-purpose CAs and the certificate
+    templates; p2s.ca_name and the vpn-router/p2s_ca_name question are
+    replaced by pki.root_name and vpn-router/pki_root_name.
+  * Without the root key on the router, new issuing CAs wait with a CSR
+    for an offline signature; vpn-router-ca exports, removes and imports
+    the root key, imports the signed certificates and a root CRL, issues
+    certificates from a CSR or into a PFX file, lists and revokes them.
+  * Certificates name their issuer's certificate and CRL at the
+    endpoints of pki.publish: the status port over HTTP, or Caddy on port
+    80, on the HTTPS status port or on port 443; the CRLs are signed
+    again at every revocation and by vpn-router-pki.timer.
+  * A general-purpose CA with acme backs an ACME server of Caddy.
+  * The router renews its own certificates before they expire.
+  * A site-to-site connection with auth certificate authenticates with
+    the router's site-to-site certificate and trusts the s2s CA or the
+    connection's remote_ca.
+  * /ca of the status web service shows and changes the PKI; /pki/
+    serves the published certificates and CRLs; /config shows the
+    installed Caddy and its source; request bodies may be 64 KiB.
+  * vpn-router no longer depends on caddy: vpn-router-setup installs it
+    from https.caddy_source, the Ubuntu archive or Caddy's repository,
+    and vpn-router-caddy use-upstream switches an installed router to
+    Caddy's repository for good.
+  * The package depends on python3-cryptography instead of openssl, and
+    simple-ca is gone.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Thu, 29 Oct 2026 10:00:00 +0100
+
 vpn-router (0.20.0-1) unstable; urgency=medium

  feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.