## 3.0.0

  * This project no longer pulls in bouncycastle as a runtime dependency,
    consumers will need to specify it themselves.
  * This project is now compatible with both the opensource and FIPS
    certified vesions of bouncycastle.

## 2.0.0

  * Allow certificate and CRL chains to be in any order
  * This changes the API for `pem->ca-crl`

## 1.0.2

  * Update bouncycastle for minor security fixes

## 1.0.1

  * Add methods to create and retrieve IP SANs extensions

## 1.0.0

  * Support loading CRL chains

## 0.9.1

  * Relax schema constraints on generate-ssl-context

## 0.9.0 (2017-08-10)

  * Added lein-parent/clj-parent to set common project dependency versions
  * Function pre/post assertions converted to schemas
  * Added new methods for interacting with certificate bundles and key pairs:
    * `pem->ca-cert`
    * `SSLUtils.pemToCaCert`
    * `SSLUtils.pemTokeyPairs`
    * `SSLUtils.pemTokeyPair`
    * `SSLUtils.certMatchesPubKey`

## 0.8.3 (2016-11-16)
 * Bumps bouncycastle dependency to latest version (1.55)

## 0.8.2
 * Adds `get-subject-from-x509-certificate` and `SSLUtils.getSubjectFromX509Certificate`
   helper methods.

## 0.8.1
 * Fixed problems decoding General Names extensions with values of the type
   "other names."
 * IP addresses General Names are now properly decoded.
 * Introduced new convenience functions for accomplishing common tasks in the
   `puppetlabs.ssl-utils.simple` namespace.

## 0.8.0
 * Added `generate-ssl-context`, a function which, when given a map of options,
   extracts any relevant SSL options and, if any are present, uses them to
   configure an SSLContext.
 * Change signing of X.509 extensions to adhere to the RFC 5280 standard
 * Fix bug in isSubtreeOf wherein extra trailing digits could incorrectly
   be treated as valid.

## 0.7.0
 * Renamed project to jvm-ssl-utils
 * Renamed Clojure namespace from puppetlabs.certificate-authority to puppetlabs.ssl-utils
 * Renamed Java package from com.puppetlabs.certificate_authority to com.puppetlabs.ssl_utils
 * Renamed CertificateAuthority class to SSLUtils

## 0.6.1
 * Added `get-cn-from-x509-certificate` to wrap getSubjectX500Principal and get-cn-from-x500-principal

## 0.6.0
 * Added support for revoking certificates
   * New `revoke` function for adding a certificate to a CRL
   * New `revoked?` function for checking whether a certificate is on a CRL
 * Removed the extensions argument from `generate-crl`
   * The AuthorityKeyIdentifier and CRLNumber extensions are now automatically added
 * Added `fingerprint` for calculating the hash of a certificate or CSR
 * Added `get-subject-dns-alt-names` to get the list of DNS alt names from a cert or CSR
 * Added `get-serial` for pulling the serial number off a certificate
 * Defined constants for OIDs:
   * CRLNumber
   * AuthorityKeyIdentifier
   * SubjectAlternativeName

## 0.5.0
 * Added support for loading chained certificates into a key store, involving the following API changes:
   * New overload of the `associatePrivateKey` Java method which accepts a `List<X509Certificate>`.
   * Removal of the restriction on the `associatePrivateKeyFromReader` Java method and
    `assoc-private-key!` Clojure function to a single certificate.

## 0.4.0
 * Added support for `authority-key-identifier` to specify the distinguished name and serial number of
   the issuer.
 * Split `basic-constraints` into `basic-constraints-for-non-ca` vs. `basic-constraints-for-ca` and allow
   a CA to not set a `max-path-len` (as opposed to it being implicitly set to 0 if not specified).
 * New `crl-number` function for use in generating a CRL Number extension.
 * New `signature-valid?` function for use in determining if the CSR has a valid signature on it.
 * Added ability to specify extensions to be added to a CRL in a call to `generate-crl`.

## 0.3.3
 * If an extension is read that has an unrecognized OID then it is parsed as a string.

## 0.3.2
 * Fixed bugs in how extensions are read and written to signing requests

## 0.3.1
 * Added functions to create a number of common X.509 extensions to certificates and signing requests.
    * Netscape certificate comment
    * authority key identifier
    * subject key identifier
    * key usage
    * extended key usage
    * basic constraints 
    
## 0.3.0
 * Strings are now used to represent X.500 names, instead of Bouncy Castle X500Name objects.
 * The `cn` and `dn` functions are added to facilitate creating X.500 names.
 * Removed the `sign-certificate-request`, and added `sign-certificate` to replace it. 
 * Rudimentary X.500 certificate extension support has been added.
    * Can now extract a number of common certificate extensions
    * Can add Subject and Issuer DNS alternative names to certificates upon signing.

## 0.2.2
 * New `get-cn-from-x500-principal` function to extract the CN from a DN stored in an `X500Principal` object
 * New `get-extensions` function retrieve extension OIDs and values on an object which implements `X509Extension`  

## 0.2.1
 * New `pem->public-key` function

## 0.2.0
 * New `pem->crl` and `crl->pem!` functions for working with CRLs
 * New `pem->cert` and `cert->pem!` functions for working with a certificate
 * Remove `issued-by?` and `has-subject?` functions from API

## 0.1.5
 * New predicate functions for checking the types of various objects
 * Deployment artifacts now include a source jar, which contains the java sources
 * Explicitly target JDK 1.6 when compiling java files
