dotnet-certes 4.0.0

.NET 10.0 This package targets .NET 10.0. The package is compatible with this framework or higher. 
dotnet tool install --global dotnet-certes --version 4.0.0
This package contains a .NET tool you can call from the shell/command line. 
dotnet new tool-manifest
                    


                            if you are setting up this repo
                        

                    

                
dotnet tool install --local dotnet-certes --version 4.0.0
This package contains a .NET tool you can call from the shell/command line. 
#tool dotnet:?package=dotnet-certes&version=4.0.0
                    


                    

                
nuke :add-package dotnet-certes --version 4.0.0

dotnet-certes

dotnet-certes is a command-line ACME client built on the Certes library. It manages ACME accounts, orders and challenges, and exports issued certificates as PEM or PFX.

Requires the .NET 10 runtime.

dotnet tool install --global dotnet-certes --prerelease
certes --help

--prerelease is needed while 4.x is in prerelease; without it, the tool installs the latest stable version (3.x).

Settings, including the account key, are stored in a user settings file. Keep that file private.

Documentation

Licensed under the MIT license.

Product Compatible and additional computed target framework versions.
.NET net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

Version Downloads Last Updated
4.0.0 44 9/23/2026
4.0.0-beta.1 45 9/23/2026
3.0.4 6,058 1/4/2023
3.0.3 5,615 10/4/2021
3.0.2-beta0008 547 10/4/2021
3.0.0 3,944 7/18/2021
3.0.0-beta0122 500 10/4/2021
3.0.0-beta0119 562 7/18/2021
3.0.0-beta0001 504 7/18/2021
2.4.0-beta0001 462 6/1/2021
1.0.6 5,283 4/5/2020
1.0.5 3,998 4/4/2020
1.0.4 3,873 3/27/2020
1.0.3 6,093 7/25/2018
1.0.2 4,736 7/13/2018
1.0.1 4,803 5/31/2018
Loading failed

### Breaking changes
- PFX export now encrypts the private key and certificates with AES-256-CBC
 (PBES2, PBKDF2 with HMAC-SHA256) instead of 3DES and 40-bit RC2. OpenSSL 3 and
 Android reject the old algorithms, so PFX files from earlier versions failed to
 load there without OpenSSL's legacy provider. Windows Server 2016 and earlier
 cannot read AES-encrypted PFX files; set `PfxBuilder.Encryption` to
 `PfxEncryption.Legacy`, or pass `--legacy-encryption` to `certes cert pfx`, to
 keep the old algorithms. The PFX integrity check remains HMAC-SHA1 with 1024
 iterations, because BouncyCastle does not expose other settings.

### Fixed
- `IOrderContextExtensions.Generate` now waits for an order to become `ready`
 before sending finalize. Previously it could finalize while the order was still
 `pending`, which ACME servers reject. The `retryCount` budget remains shared
 between this pre-finalize wait and post-finalize polling of `pending`/
 `processing`. If challenge validation was never triggered, this can wait up to
 60 server-directed `Retry-After` intervals by default.

### Changed
- `CertificateChainExtensions.ToPem` now always emits LF (`\n`) line endings,
 avoiding mixed `\r\n`/`\n` output across platforms.

Full changelog: https://github.com/fszlin/certes/blob/v4.0.0/docs/CHANGELOG.md