SVN and the overnight zip have been updated with a new ICS beta, with a lot of SSL/TLS changes. Took a little longer than expected due to adding support for new certificate suppliers and a major sample upgrade.
Since Let's Encrypt introduced the ACME (Automatic Certificate Management Environment) protocol to download SSL/TLS certificates, other suppliers have added automated ordering using the same API, mostly with extra account information for commercial certificates. ICS has been tested successfully with free certificates from Google Trust Services and Buypass, and should work with DigiCert, ZeroSSL and SSLcom, but these last three are primarily commercial suppliers and need prepaid accounts, so not tested yet.
Google Trust Services offers an excellent alternate to Let's Encrypt and offers almost the same free certificates up to 90 days with multiple wildcards, but allows the expiry days to be specified during ordering, down to three days. Some companies were reluctant to use Let's Encrypt when there was no alternative in case of extended down time, now Google offers that alternate. Bypass is a Norwegian business, offers free 180 day certificates but no wild cards and only five domains per certificate, but may be suitable for those that don't want to use American certificates.
Apart from Let's Encrypt and Buypass, suppliers use ACME external accounting to tie the ordering process to web site accounts, which is explained in comments in the OverbyteIcsSslX509Certs unit, more information will be added and the wiki pages updated before release. Google needs the Google Cloud CLI Windows application installing, type a few commands and you get the external account information Acme needs. The OverbyteIcsX509CertsTst sample has a major revision to support multiple account suppliers and to specify the external accounting information. The sample needs to be run on any servers that will order certificates to create the initial Acme account (except for Let's Encrypt), and includes a web server allowing test certificates to be ordered provided DNS points to a public IP on the server. Most suppliers provide a testing endpoint which is listed in OverbyteIcsX509CertsTst so you can order fake certificates to understand the process.
OCSP is being deprecated by the industry in favour of shorter expiry certificates, Let's Encrypt stopped adding an OCSP URL to certificates in May 2025 and will turn off it's OCSP servers in August 2025. This means OCSP Stapling no longer works, nor checking OCSP during chain verification. ICS has two new defines OpenSSL_OcspStaple and OpenSSL_OcspChains defaulting to false, that need to set to enable ICS to continue using OCSP for any suppliers still supporting it. The default saves a lot of extra OCSP code being linked into applications. When existing projects with server components are opened, 'Error reading: xx: Property OcspSrvStapling does not exist' may appear, just click past it and the property will be removed from the form.
To replace OCSP for servers, the ACME specification now supports a renewal information API, that for each certificate provides a recommended date range when the certificate should be renewed, which may change dynamically if the certificate is revoked. ICS servers now check certificate renewal information, usually every six hours.
ACME certificate profiles are now supported, currently Let's Encrypt only, default classic, optional tlsserver and shortlived (7 day, not yet available).
Angus