[domenkozar]

Credential generators from #417 merged into a feature branch after its parent PR had landed, leaving x509_identity and the other additional types unavailable on main. Integrate those generators with the current resolver and native SDKs, using Rust certificate and PKCS#12 libraries for X.509 operations.

• Add passphrase, BIP-39 mnemonic, WireGuard, JWK, age, and self-signed P-256 X.509 generation.
• Resolve from conversions, JSON/INI selections, and typed password credentials through the shared dependency graph. Support PEM/DER keys and certificates, certificate chains, and password-protected PKCS#12 archives while preserving scoped output, file ownership, and credential refresh deadlines.
• Replace vendored OpenSSL with rcgen, x509-parser, and p12-keystore. Certificate crypto uses the existing AWS-LC backend. Import RSA, P-256, P-384, P-521, and Ed25519 keys; consume every certificate bag and reject unrelated, duplicate, or ambiguous chains. Export AES-256-CBC/PBKDF2-HMAC-SHA-256 archives with a SHA-256 MAC and 100,000 iterations.
• Use published p12-keystore 0.4.1, including the bag-preserving archive API and merged Unicode certificate-label fix. Certificate DER and local key IDs survive Unicode-subject rewrapping; only unrepresentable generated BMP bag labels are omitted. Passwords still support the Unicode Basic Multilingual Plane until RustCrypto/formats#2477 ships.
• Validate self-issued certificates against their supplied issuer's key instead of assuming matching names imply self-signing. Redact hidden conversion and selection sources in scoped explanations. Correct the public from version label to 0.22.
• Remove OpenSSL-specific Windows Haskell build setup and serialize provider paths in the credential-deadline test so Windows backslashes cannot break its TOML manifest. Mark new surfaces as 0.22+, retain 0.21+ labels for released OpenPGP/SSH generation, and update the schema, changelog, and release instructions.

Release gate: publish the matching IPC crate first, then verify the packaged crate. The p12-keystore release prerequisite is complete: the minimum registry version is 0.4.1, with no Git override. RELEASE.md records the remaining steps and the separate supplementary-Unicode password follow-up.

Validation on the Rust 1.92 toolchain (full-suite results below precede the final review fixes):

CI passed on final head bb01b977: Rust tests on Ubuntu, macOS, and Windows; feature and package checks; documentation; the language SDK suite and Swift SDK; and Haskell builds on Linux and Windows.

• cargo test --workspace --exclude secretspec-php-native --offline: passed, including 1,813 core tests (four ignored), derive compile-fail snapshots, IPC conformance, integration tests, native bindings, and doctests. The PHP extension is excluded as in native CI.
• cargo check -p secretspec --no-default-features --offline: passed.
• Repository prek run -a hooks: passed, including full-workspace Clippy with PHP headers and rustfmt.
• Documentation build and link check: 99 pages, zero diagnostics, zero broken links.
• cargo package -p secretspec --allow-dirty --no-verify --locked --offline: passed again with p12-keystore 0.4.1; the packaged manifest requires registry version 0.4.1 without a Git override. Full package verification resolves the new archive API, then fails on the existing MAX_JSON_INTEGER references because the published secretspec-ipc 0.21.1 predates current main. Publish the matching IPC crate first and rerun verification as documented in RELEASE.md.
• Earlier registry dependency checks (superseded by 0.4.1): interoperability tests passed with p12-keystore 0.4.0 and the supported ChaCha20 0.10.2 patch. The registry crate checksum matches the index, and its sources match the previously tested archive-API fix.
• OpenSSL-generated import fixtures cover every supported key type, legacy 3DES, and BMP passwords. Independent OpenSSL CLI verification of Rust exports confirms encryption/MAC settings, matching keys, SAN/EKU constraints, owner-only files, wrong-password rejection, and persistent stored identities.
• After synchronizing with main, the credential-deadline test and configuration schema/warning tests passed. The Windows fixture now escapes provider paths through TOML serialization.
• Published-release validation: all 15 X.509 tests passed again with registry p12-keystore 0.4.1, including Unicode leaf/issuer rewrapping and OpenSSL import interoperability. Packaging passed and its manifest requires registry 0.4.1 without Git. Staged-file repository hooks correctly skipped Rust checks because no Rust source changed.
• Active Linux and Windows MSVC dependency graphs contain no OpenSSL.
• Review-fix validation: all 15 X.509 tests and the scoped-report regression passed with the new pin. CLI reproducers passed for Unicode subjects, self-issued certificates, and scoped explanations; OpenSSL independently accepted the rewrapped archive. Documentation validation passed again (99 pages, zero diagnostics or broken links). Upstream tests, Clippy, formatting, and CI passed. Repository hooks passed again, including workspace Clippy with PHP bindings and rustfmt. The published 0.4.1 Rust sources match the tested fix, and the downloaded crate checksum matches the registry index.

Fixes #481. Implements the X.509 backend transition tracked in #484; supplementary-Unicode support remains an upstream release follow-up.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	secretspec	bb01b97	Commit Preview URL Branch Preview URL	Oct 13 2026, 05:25 PM