Home › Docs › Changelog

Changelog

User-visible changes in each release, newest first. Binaries and checksums are on the GitHub releases page.

v0.8.1 · 2026-09-26

• intermediate-ca no longer prints Note: validity capped at the issuer's expiry for a default intermediate under a fresh root. Both default to 2190 days, so the intermediate overshot the root by the seconds between the two commands. The note now appears only when the cut is longer than an hour.
• The website is split into a home page and a documentation section, with search and a release badge.

v0.8.0 · 2026-09-26

• --validity on every command that signs: days (90d) or a Go duration (24h). A certificate is capped at its issuer's expiry, with a note. See Server and client certificates.
• client-cert --san, for URI SANs such as SPIFFE IDs.
• --key-type ed25519.
• --pkcs12 and --pkcs12-password on server-cert and client-cert.
• New revoke and crl commands: intermediate CRL, root CRL and a CRL chain file. Leaf list reports revoked certificates. See Revocation.
• trust covers the Linux system store (Debian, Ubuntu, Alpine, Fedora, RHEL, Arch, openSUSE), Firefox/NSS through certutil and Java cacerts through keytool, selected with --store. See Trusting the root CA.
• Go package: VerifyRoot, VerifyIntermediate, a nil-safe VerifyChain, LoadCerts for chain files, and Permit*/Exclude* builders for NameConstraints. See Go package.

v0.7.1 · 2026-09-26

• root-ca list checks the self-signature, so a certificate that is not a root no longer lists as valid.
• Unit tests for issuance and every command.

v0.7.0 · 2026-09-26

• Certificates are issued with Go's crypto/x509. OpenSSL no longer needs to be installed.
• No CA database: re-issuing a subject overwrites its files. Workdirs from older releases keep working; their OpenSSL files are ignored and --force on a tier removes them.
• Random 128-bit serial numbers, NotBefore backdated 5 minutes.
• The signature digest follows the issuer's key: SHA-256 for RSA and P-256, SHA-384 for P-384, SHA-512 for P-521.
• Leaves are verified against their chain before anything is written.
• sign takes only the subject and SANs from a request. --name-constraint no longer accepts dirName.

v0.6.0 · 2026-09-26

• --name-constraint on root-ca and intermediate-ca, in openssl syntax, written as a critical extension. Leaves outside the constraints are refused. See Name constraints.

v0.5.0 · 2026-09-22

• New trust command: install, remove and check a Root CA in the macOS System keychain.
• New sign command for certificate requests generated elsewhere.
• --key-type for ECDSA keys: ecdsa/ecdsa-p256, ecdsa-p384, ecdsa-p521.
• Generate commands refuse to overwrite existing material. --force replaces it.
• The website at bcollard.github.io/homepki.

v0.4.0 · 2026-09-18

• New skill command: skill install, skill path, skill install --print. See Agent Skill.

v0.3.0 · 2026-05-24

• server-cert --san for extra Subject Alternative Names, with DNS:, IP:, email: and URI: prefixes or automatic detection.

v0.2.0 – v0.2.4 · 2026-04-06 to 2026-04-11

• Chain verification in every list subcommand, and -o json output (v0.2.0).
• Short names: ls and l for list, v for version (v0.2.3).
• server-cert list and client-cert list report an empty list instead of an error when no leaf exists yet (v0.2.4).
• Installed as a Homebrew cask: brew install --cask homepki (v0.2.2). Release packaging fixes (v0.2.1).

v0.1.0 – v0.1.6 · 2025-12-04

• First release as a Go CLI: root-ca, intermediate-ca, server-cert and client-cert, each with a list subcommand.
• Releases built by GoReleaser and published to the bcollard/homepki Homebrew tap. v0.1.1 to v0.1.6 fixed the release pipeline only.