PR: https://github.com/vyos/vyos-1x/pull/4419

Thanks for the quick fix!

The correct signing key is back now.

Thank you very much @Embezzle - This is a feature I've been hoping for for a long time (at the moment I have a script that runs via VyOS cron and updates a firewall filter and commits it) - really appreciate you taking the time to do this piece of work.
Much Love.

Just to add a little more information:
This does not happen on vyos-1.5-stream-2025-Q1 (although this release also has issues regarding the state policy: https://forum.vyos.io/t/have-to-delete-firewall-global-options-state-policy-invalid-after-upgrading-to-1-5-stream-2025-q1/16131/7)

Tested as working in: VyOS 2025.03.26-0018-rolling

Opened an issue https://github.com/OpenVPN/openvpn/issues/709

New VyOS CLI option disable-establish-hello should be implemented in https://vyos.dev/T7286 (for the current)

PR https://github.com/vyos/vyos-1x/pull/4416

I have drafted https://github.com/vyos/libpam-radius-auth/pull/9 with the relevant commits cherry-picked from the upstream FreeRADIUS repo. I haven't been able to test the build yet due to some (probably) unrelated issues with apt in a Debian container.

T5493 is merged

https://github.com/vyos/vyos-vpp/pull/24

Yes - this has been included in the nightly builds for a few weeks now.

Is this resolved on the latest nightly, now that T7177 has been resolved?

Decided to not replace the functionality for all methods, only where I found a problem. This means the information in this issue isn't relevant. I'll make a new issue to fix the test case above.

The version of lego in the Debian repositories is very old, and this will likely mean it is broken for various DNS providers since things change rapidly out there on the Internet. As an example, Porkbun DNS provider has recently changed the URL for their DNS API, which has been updated in the newest LEGO, but the old version in the debian repos no longer works for Porkbun. I believe updating LEGO in the debian repos is hard due to needing to bring each go dependency into the repos also - which means the LEGO version is even old in the debian unstable repos.

A key decision in implementing this dns-01 acme authentication feature is whether or not to change the upstream tool used to obtain let's encrypt certificates (currently certbot).

Will this be backported to 1.4 ahead of the 1.4.2 release?

I am tired of Network Management complacation, I am tired to change different management cli command if switch diffrent brand router, I need automation, so I switch to netconf to config, I ask chatgpt, what router support, It said VyOS, But VyOS not support NetConf infact, I hope someday it could.

Related PR from GitHub: PR #4414