New features

• #1948 - In the menu Manage renewals > Edit renewal is now possible to choose which stage of the renewal you would like to modify. So instead of completely reconfiguring it, you can also change specific behaviour like source, validation, installation, etc.
• #1760 - FTP bindings can now be automatically read/updated from IIS in the source stage, the sites and host names simply show up in the lists when configuring a renewal. This change required us merge the IISFTP installation plugin into the regular IIS. This was done in a way that's fully backwards compatible with existing renewals. Requested by @luigirosa and others.
• #1646 - It's now possible to configure global pre- and post renewal scripts, that will be called before and after executing a renewal. The relevant configuration values are Execution.DefaultPreExecutionScript and Execution.DefaultPostExecutionScript in settings.json. The use case for this is to prepare the system to handle validation, e.g. by opening certain firewall ports. Requested by @ThomasCr and many others.

Enhancements

• An global order cache has been implemented to prevent users from hitting rate limits, even across different and new renewals. This was a tricky feature to implement because each renewal can have different opinions on which (type of) private key they would like to use. Also we still need to keep track of changes in the source since the previously issued certificate, mandating an effective two-level caching structure. So there is now a first-level cache for the renewal itself and a second-level cache at the global level.
• #1824 - When the server indicates that it's too busy, the client will now gracefully back off in five steps between 8 and 128 seconds before retrying the request. A bug in handling this scenario caused #1824 reported by @nathanajci and many others, especially when running the scheduled task at exactly 9:00 am (as opposed to with a random delay). Special thanks to @xpepos to figuring out the root cause.
• #1966 - Optimized the place and layout of the possible parameters during interactive setup of the script installation plugin, suggested by @AvrumFeldman.
• Update a whole range of third party dependencies.

Example script updates

• New version of the Exchange script based on #1372 by @JT-Moore and others.
• New version of the WinRM script contributed by @oWretch in #1977.
• Improved exception handling for the RDS script by @The00Dustin (#1957).

Bug fixes

• #1947 - GoDaddy validation was broken in 2.1.19 due to an attempted bugfix, reported by @bl-abolis.
• #1969 - The installation stage would crash if no store option had been selected, reported by @Zennate.
• #1967 - The Azure KeyVault plugin was missing an assembly causing an (otherwise harmless) error message at startup., reported by @neilsleightholm-paxton.
• #1968 - In some cases upgrading from a version older than 2.1.18 would trigger all the certiificates to be renewed, reported by @zachol72.
• #1972 - It was not possible to use the secret vault for the Azure KeyVault plugin, reported by @samrueby.
• #1980 - It was not possible to set up new renewals using the TransIP plugin due to a validation logic bug, reported by @EddieDemon.