Skip to content

feat: unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distribution Point marshaling - #2511

Merged
maraino merged 12 commits into
smallstep:masterfrom
savely-krasovsky:master
Mar 18, 2026
Merged

feat: unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distribution Point marshaling#2511
maraino merged 12 commits into
smallstep:masterfrom
savely-krasovsky:master

Conversation

@savely-krasovsky

@savely-krasovsky savely-krasovsky commented Jan 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Name of feature:

Unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distribution Point marshaling.

Pain or issue this feature alleviates:

Why is this important to the project (if not answered above):

Is there documentation on how to use this feature? If so, where?

In what environments or workflows is this feature supported?

In what environments or workflows is this feature explicitly NOT supported (if any)?

Supporting links/other PRs/issues:

💔Thank you!

@CLAassistant

CLAassistant commented Jan 5, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@CLAassistant

CLAassistant commented Jan 5, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@github-actions github-actions Bot added the needs triage Waiting for discussion / prioritization by team label Jan 5, 2026
@savely-krasovsky savely-krasovsky mentioned this pull request Jan 5, 2026
Open
maraino
maraino reviewed Jan 7, 2026
View reviewed changes

@maraino maraino left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't tried, but my I think that if you set idpOnlyContainsCACerts and you revoke a "user" certificate, that will also appear in the CRL.

@savely-krasovsky

savely-krasovsky commented Jan 7, 2026

Copy link
Copy Markdown
Contributor Author

If there is no special reason to set OnlyUser I think it would make sense to just disable it. Specification says you must set either distribution point or one of those flags on, but in our case DP is already set, so both flags could be unset.

@savely-krasovsky

savely-krasovsky commented Jan 7, 2026

Copy link
Copy Markdown
Contributor Author

@maraino what do you think about the change like that? I don't see any particular reason why those params are set. step-ca CRL list could contain both CA and user certs.

@savely-krasovsky savely-krasovsky changed the title feat: add options to configure CRL IDP flags feat: unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distubution Point marshaling Jan 7, 2026
@savely-krasovsky savely-krasovsky changed the title feat: unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distubution Point marshaling feat: unset OnlyContainsUserCerts and OnlyContainsCACerts options during Distribution Point marshaling Jan 7, 2026
@maraino

maraino commented Jan 7, 2026

Copy link
Copy Markdown
Contributor

@maraino what do you think about the change like that? I don't see any particular reason why those params are set. step-ca CRL list could contain both CA and user certs.

That makes more sense to me, we'll include this in our next triage.

@maraino
maraino self-requested a review January 7, 2026 18:54
@filimonic

filimonic commented Jan 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CA/Browser forum, Baseline Requirements 2.2.2,

Please see Google's newest AE1 subordinate certificate and it's CRL

@savely-krasovsky

savely-krasovsky commented Jan 21, 2026

Copy link
Copy Markdown
Contributor Author

Can I ask for the current status?

@savely-krasovsky

savely-krasovsky commented Mar 10, 2026

Copy link
Copy Markdown
Contributor Author

@maraino any news?

maraino
maraino approved these changes Mar 18, 2026
View reviewed changes

@maraino maraino left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @savely-krasovsky, I've forgot about this, but it will be in a release tomorrow.

@maraino
maraino merged commit d4103d6 into smallstep:master Mar 18, 2026
1 check passed
liujed pushed a commit to liujed/caddy-dns01proxy that referenced this pull request Mar 29, 2026
@dependabot
Bump github.com/smallstep/certificates from 0.30.0-rc3 to 0.30.2 (#30)
1061f7c 
Bumps
[github.com/smallstep/certificates](https://github.com/smallstep/certificates)
from 0.30.0-rc3 to 0.30.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/smallstep/certificates/releases">github.com/smallstep/certificates's
releases</a>.</em></p>
<blockquote>
<h2>Step CA v0.30.2 (26-03-23)</h2>
<h2>Official Release Artifacts</h2>
<h4>Linux</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_linux_0.30.2_amd64.tar.gz">step-ca_linux_0.30.2_amd64.tar.gz</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_0.30.2-1_amd64.deb">step-ca_0.30.2-1_amd64.deb</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca-0.30.2-1.x86_64.rpm">step-ca-0.30.2-1.x86_64.rpm</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_0.30.2-1_arm64.deb">step-ca_0.30.2-1_arm64.deb</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca-0.30.2-1.aarch64.rpm">step-ca-0.30.2-1.aarch64.rpm</a></li>
</ul>
<h4>OSX Darwin</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_darwin_0.30.2_amd64.tar.gz">step-ca_darwin_0.30.2_amd64.tar.gz</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_darwin_0.30.2_arm64.tar.gz">step-ca_darwin_0.30.2_arm64.tar.gz</a></li>
</ul>
<h4>Windows</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.2/step-ca_windows_0.30.2_amd64.zip">step-ca_windows_0.30.2_amd64.zip</a></li>
</ul>
<p>For more builds across platforms and architectures, see the
<code>Assets</code> section below.
And for packaged versions (Docker, k8s, Homebrew), see our <a
href="https://smallstep.com/docs/step-ca/installation">installation
docs</a>.</p>
<p>Don't see the artifact you need? Open an issue <a
href="https://github.com/smallstep/certificates/issues/new/choose">here</a>.</p>
<h2>Signatures and Checksums</h2>
<p><code>step-ca</code> uses <a
href="https://github.com/sigstore/cosign">sigstore/cosign</a> for
signing and verifying release artifacts.</p>
<p>Below is an example using <code>cosign</code> to verify a release
artifact:</p>
<pre><code>cosign verify-blob \
  --bundle step-ca_darwin_0.30.2_amd64.tar.gz.sigstore.json \
--certificate-identity-regexp
&quot;https://github\.com/smallstep/workflows/.*&quot; \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.30.2_amd64.tar.gz
</code></pre>
<p>The <code>checksums.txt</code> file (in the <code>Assets</code>
section below) contains a checksum for every artifact in the
release.</p>
<h2>Changelog</h2>
<ul>
<li>6e8ec61405239cf3f37b2bbf260a587b7d2e4e31 Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2606">#2606</a>
from smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3</li>
<li>90b84cdf15ca2f998129c859e227f3b0fcd7d732 Bump google.golang.org/grpc
from 1.79.2 to 1.79.3</li>
</ul>
<h2>Thanks!</h2>
<p>Those were the changes on v0.30.2!</p>
<p>Come join us on <a href="https://discord.gg/X2RKGwEbV9">Discord</a>
to ask questions, chat about PKI, or get a sneak peek at the freshest
PKI memes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/smallstep/certificates/blob/master/CHANGELOG.md">github.com/smallstep/certificates's
changelog</a>.</em></p>
<blockquote>
<h2>[0.30.2] - 2026-03-22</h2>
<ul>
<li>Update golang.org/grpc to patch security advisory</li>
</ul>
<h3>[0.30.1] - 2026-03-18</h3>
<ul>
<li>Fix release issue</li>
</ul>
<h3>[0.30.0] - 2026-03-18</h3>
<h3>Added</h3>
<ul>
<li><code>smallstep/certificates#2526</code></li>
<li><code>smallstep/certificates#2570</code></li>
<li><code>smallstep/certificates#2533</code></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade HSM-enabled Docker images from Debian Bookworm (12) to
Debian Trixie
<code>smallstep/certificates#2493</code></li>
<li>Use JSON array format for Dockerfile's <code>CMD</code> instruction.
This prevents shell
interpolation of environment variables like <code>CONFIGPATH</code> and
<code>PWDPATH</code>,
ensuring consistent command execution. Commands can still be overridden
via
<code>smallstep/certificates#2493</code></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix CRL IssuingDistributionPoint marshaling to correctly unset
<code>OnlyContainsUserCerts</code> and
<code>OnlyContainsCACerts</code><code>smallstep/certificates#2511</code></li>
<li>Fix CRL DER download content-disposition filename extension from
<code>.der</code> to
<code>.crl</code><code>smallstep/certificates#2537</code></li>
<li><code>smallstep/certificates#2379</code></li>
<li><code>smallstep/certificates#1893</code></li>
<li><code>smallstep/certificates#2513</code></li>
<li><code>smallstep/certificates#2569</code></li>
<li><code>smallstep/certificates#2517</code></li>
<li><code>smallstep/certificates#2515</code></li>
</ul>
<h2>[0.29.0] - 2025-12-03</h2>
<h3>Added</h3>
<ul>
<li><code>smallstep/certificates#2370</code></li>
<li><code>smallstep/certificates#2382</code></li>
<li><code>smallstep/certificates#2408</code></li>
<li><code>smallstep/certificates#2461</code></li>
<li><code>smallstep/certificates#2463</code></li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/smallstep/certificates/commit/6e8ec61405239cf3f37b2bbf260a587b7d2e4e31"><code>6e8ec61</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2606">#2606</a>
from smallstep/dependabot/go_modules/google.golang.o...</li>
<li><a
href="https://github.com/smallstep/certificates/commit/90b84cdf15ca2f998129c859e227f3b0fcd7d732"><code>90b84cd</code></a>
Bump google.golang.org/grpc from 1.79.2 to 1.79.3</li>
<li><a
href="https://github.com/smallstep/certificates/commit/10c9392c3f90b1738eadb31db32501dd4ae91e0f"><code>10c9392</code></a>
Changelog update v0.30.1 (<a
href="https://redirect.github.com/smallstep/certificates/issues/2605">#2605</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0"><code>d34619c</code></a>
Update CHANGELOG for 0.30.0 (<a
href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/cfcbe4c2f93ec7e7f0347b4d0190353946189be7"><code>cfcbe4c</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a>
from smallstep/mariano/scep-type-check</li>
<li><a
href="https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef"><code>e6da031</code></a>
Add scep integration tests</li>
<li><a
href="https://github.com/smallstep/certificates/commit/d4103d6626a6b1e95223610b7fc46757aaa255b8"><code>d4103d6</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a>
from savely-krasovsky/master</li>
<li><a
href="https://github.com/smallstep/certificates/commit/07e4424836212198eaabed92517a98e0ec993175"><code>07e4424</code></a>
Add revocation reason code to CRL | replace deprecated
pkix.RevokeCertificate</li>
<li><a
href="https://github.com/smallstep/certificates/commit/3ce51133ce4aa786796e6cbff04ead25e7ac8c6b"><code>3ce5113</code></a>
Bump nosql and crypto (<a
href="https://redirect.github.com/smallstep/certificates/issues/2600">#2600</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/927ecc7bafcafac228b337d7acf2113491edec01"><code>927ecc7</code></a>
Add actions and security-events permissions to release CI job (<a
href="https://redirect.github.com/smallstep/certificates/issues/2593">#2593</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/smallstep/certificates/compare/v0.30.0-rc3...v0.30.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions Bot pushed a commit to CruGlobal/mirage-server that referenced this pull request Jul 31, 2026
@dependabot
deps(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.3…
013e029 
…0.0 (#26)

Bumps
[github.com/smallstep/certificates](https://github.com/smallstep/certificates)
from 0.28.4 to 0.30.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/smallstep/certificates/releases">github.com/smallstep/certificates's
releases</a>.</em></p>
<blockquote>
<h2>Release v0.30.0</h2>
<p>No release notes provided.</p>
<h2>Step CA v0.30.0-rc7 (26-03-18)</h2>
<h2>Official Release Artifacts</h2>
<h4>Linux</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_linux_0.30.0-rc7_amd64.tar.gz">step-ca_linux_0.30.0-rc7_amd64.tar.gz</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_0.30.0.rc7-1_amd64.deb">step-ca_0.30.0.rc7-1_amd64.deb</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca-0.30.0.rc7-1.x86_64.rpm">step-ca-0.30.0.rc7-1.x86_64.rpm</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_0.30.0.rc7-1_arm64.deb">step-ca_0.30.0.rc7-1_arm64.deb</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca-0.30.0.rc7-1.aarch64.rpm">step-ca-0.30.0.rc7-1.aarch64.rpm</a></li>
</ul>
<h4>OSX Darwin</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_darwin_0.30.0-rc7_amd64.tar.gz">step-ca_darwin_0.30.0-rc7_amd64.tar.gz</a></li>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_darwin_0.30.0-rc7_arm64.tar.gz">step-ca_darwin_0.30.0-rc7_arm64.tar.gz</a></li>
</ul>
<h4>Windows</h4>
<ul>
<li>📦 <a
href="https://dl.smallstep.com/gh-release/certificates/gh-release-header/v0.30.0-rc7/step-ca_windows_0.30.0-rc7_amd64.zip">step-ca_windows_0.30.0-rc7_amd64.zip</a></li>
</ul>
<p>For more builds across platforms and architectures, see the
<code>Assets</code> section below.
And for packaged versions (Docker, k8s, Homebrew), see our <a
href="https://smallstep.com/docs/step-ca/installation">installation
docs</a>.</p>
<p>Don't see the artifact you need? Open an issue <a
href="https://github.com/smallstep/certificates/issues/new/choose">here</a>.</p>
<h2>Signatures and Checksums</h2>
<p><code>step-ca</code> uses <a
href="https://github.com/sigstore/cosign">sigstore/cosign</a> for
signing and verifying release artifacts.</p>
<p>Below is an example using <code>cosign</code> to verify a release
artifact:</p>
<pre><code>cosign verify-blob \
  --bundle step-ca_darwin_0.30.0-rc7_amd64.tar.gz.sigstore.json \
--certificate-identity-regexp
&quot;https://github\.com/smallstep/workflows/.*&quot; \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
  step-ca_darwin_0.30.0-rc7_amd64.tar.gz
</code></pre>
<p>The <code>checksums.txt</code> file (in the <code>Assets</code>
section below) contains a checksum for every artifact in the
release.</p>
<h2>Changelog</h2>
<ul>
<li>d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0 Update CHANGELOG for 0.30.0
(<a
href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li>
<li>cfcbe4c2f93ec7e7f0347b4d0190353946189be7 Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a>
from smallstep/mariano/scep-type-check</li>
<li>e6da031d5125cfd99fe9a26f74bb41e4dacca4ef Add scep integration
tests</li>
<li>d4103d6626a6b1e95223610b7fc46757aaa255b8 Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a>
from savely-krasovsky/master</li>
<li>07e4424836212198eaabed92517a98e0ec993175 Add revocation reason code
to CRL | replace deprecated pkix.RevokeCertificate</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/smallstep/certificates/blob/master/CHANGELOG.md">github.com/smallstep/certificates's
changelog</a>.</em></p>
<blockquote>
<h3>[0.30.0] - 2026-03-18</h3>
<h3>Added</h3>
<ul>
<li><code>smallstep/certificates#2526</code></li>
<li><code>smallstep/certificates#2570</code></li>
<li><code>smallstep/certificates#2533</code></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Upgrade HSM-enabled Docker images from Debian Bookworm (12) to
Debian Trixie
<code>smallstep/certificates#2493</code></li>
<li>Use JSON array format for Dockerfile's <code>CMD</code> instruction.
This prevents shell
interpolation of environment variables like <code>CONFIGPATH</code> and
<code>PWDPATH</code>,
ensuring consistent command execution. Commands can still be overridden
via
<code>smallstep/certificates#2493</code></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix CRL IssuingDistributionPoint marshaling to correctly unset
<code>OnlyContainsUserCerts</code> and
<code>OnlyContainsCACerts</code><code>smallstep/certificates#2511</code></li>
<li>Fix CRL DER download content-disposition filename extension from
<code>.der</code> to
<code>.crl</code><code>smallstep/certificates#2537</code></li>
<li><code>smallstep/certificates#2379</code></li>
<li><code>smallstep/certificates#1893</code></li>
<li><code>smallstep/certificates#2513</code></li>
<li><code>smallstep/certificates#2569</code></li>
<li><code>smallstep/certificates#2517</code></li>
<li><code>smallstep/certificates#2515</code></li>
</ul>
<h2>[0.29.0] - 2025-12-03</h2>
<h3>Added</h3>
<ul>
<li><code>smallstep/certificates#2370</code></li>
<li><code>smallstep/certificates#2382</code></li>
<li><code>smallstep/certificates#2408</code></li>
<li><code>smallstep/certificates#2461</code></li>
<li><code>smallstep/certificates#2463</code></li>
</ul>
<h3>Changed</h3>
<ul>
<li><code>smallstep/certificates#2343</code></li>
</ul>
<h3>Fixed</h3>
<ul>
<li><code>smallstep/certificates#2338</code></li>
<li><code>smallstep/certificates#2435</code></li>
<li><code>smallstep/certificates#2444</code></li>
</ul>
<h3>Security</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/smallstep/certificates/commit/d34619c55e5cd46ce08d8bdb8c846df2c4d8aca0"><code>d34619c</code></a>
Update CHANGELOG for 0.30.0 (<a
href="https://redirect.github.com/smallstep/certificates/issues/2603">#2603</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/cfcbe4c2f93ec7e7f0347b4d0190353946189be7"><code>cfcbe4c</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2602">#2602</a>
from smallstep/mariano/scep-type-check</li>
<li><a
href="https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef"><code>e6da031</code></a>
Add scep integration tests</li>
<li><a
href="https://github.com/smallstep/certificates/commit/d4103d6626a6b1e95223610b7fc46757aaa255b8"><code>d4103d6</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2511">#2511</a>
from savely-krasovsky/master</li>
<li><a
href="https://github.com/smallstep/certificates/commit/07e4424836212198eaabed92517a98e0ec993175"><code>07e4424</code></a>
Add revocation reason code to CRL | replace deprecated
pkix.RevokeCertificate</li>
<li><a
href="https://github.com/smallstep/certificates/commit/3ce51133ce4aa786796e6cbff04ead25e7ac8c6b"><code>3ce5113</code></a>
Bump nosql and crypto (<a
href="https://redirect.github.com/smallstep/certificates/issues/2600">#2600</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/927ecc7bafcafac228b337d7acf2113491edec01"><code>927ecc7</code></a>
Add actions and security-events permissions to release CI job (<a
href="https://redirect.github.com/smallstep/certificates/issues/2593">#2593</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/c14008e5ad73d2b920411deabcd07b14f9828165"><code>c14008e</code></a>
Fix the test for CRL disposition (<a
href="https://redirect.github.com/smallstep/certificates/issues/2599">#2599</a>)</li>
<li><a
href="https://github.com/smallstep/certificates/commit/10cd5c20c510c14dd4e6a4a3a68a2e7e69cc7489"><code>10cd5c2</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2537">#2537</a>
from filimonic/crl-fix-crl-file-extension</li>
<li><a
href="https://github.com/smallstep/certificates/commit/6f1a2286f3bcd67729acbce8ffba75db30efed25"><code>6f1a228</code></a>
Merge pull request <a
href="https://redirect.github.com/smallstep/certificates/issues/2594">#2594</a>
from smallstep/dependabot/go_modules/github.com/goog...</li>
<li>Additional commits viewable in <a
href="https://github.com/smallstep/certificates/compare/v0.28.4...v0.30.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/smallstep/certificates&package-manager=go_modules&previous-version=0.28.4&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/CruGlobal/mirage-server/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maraino maraino maraino approved these changes

Assignees

No one assigned

Labels

needs triage Waiting for discussion / prioritization by team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@savely-krasovsky @CLAassistant @maraino @filimonic @step-ci