0.16.5

CHANGES:

• Always embed local_key_id in PKCS12 bags (reported #163 by @NightBlues,
  revised and implemented by @hannesm)

0.16.4

CHANGES:

• Adapt to mirage-crypto-rng 0.11.0 API changes (#162 @hannesm)

0.16.3

CHANGES:

• Validation: allow self-signed server certificate with BasicConstraints CA=true
  (reported by @mbacarella in mirleft/ocaml-tls#446
  (lightningnetwork/lnd#5450), fix #161 by @hannesm)

0.16.2

CHANGES:

• Improve parse error message of Authenticator.of_string (mirage/ocaml-git#593
  by @dinosaure, mirage/ocaml-git#582 by @reynir)

0.16.1

CHANGES:

• Support ECDSA signatures where the hash algorithm output length exceeds the
  size of the elliptic curve (by truncating, and using the leftmost bits).
  Reported as #158 by @torinnd, fixed in #159 by @hannesm

0.16.0

CHANGES:

• Provide X509.Authenticator.of_string to construct an Authenticator.t from
  a string (@dinosaure #156, reviewed by @hannesm)
• Minor documentation fixes (#157 @hannesm)

0.15.2

CHANGES:

• Provide X509.Private_key.of_string (as used by awa and dns-certify). This
  takes a b64 encoded raw private key or a seed. (@reynir @hannesm #155)

0.15.1

CHANGES:

• avoid usae of deprecated functions of fmt (@hannesm)
• remove rresult dependency (@hannesm)

0.15.0

CHANGES:

• FEATURE support validation of an IP address in the leaf certificate
  (#152 #153 @reynir @hannesm)
• FEATURE provide Certificate.ips and Certificate.supports_ip
  (#152 @reynir @hannesm)
• BREAKING revise certificate and public key fingerprint authenticators API:
  now a single fingerprint is supported, previously a list of pairs of
  hostname and fingerprint was used (#153 @hannesm)
• BREAKING The Authenticator.t type has been extended with ?ip:Ipaddr.t
  (#153 @hannesm)

0.14.1

CHANGES:

• Use Cstruct.length instead of deprecated Cstruct.len, bump minimum cstruct
  to 6.0.0 (#151 by @hannesm)