CA connector release notes

This page provides release notes for the Sectigo Certificate Manager (SCM) Enterprise CA connector.

The CA connector documentation can be found in the following location:

CA connector v3.6

October 24, 2026

This release includes the following updates and improvements:

General updates

Change Reference number

Sectigo CA Connector rejects any certificate chain that passes through eight specific eMudhra emSign intermediate keys, and this cannot be turned off. CA Connector fails these chains with x509: no valid chains built. This applies to outbound TLS connections where certificate verification is enabled, such as Sectigo Certificate Manager, the CA backends it manages (DigiCert, EJBCA, GlobalSign Atlas, Google Cloud CA Service), and proxies. Connections that use other CAs, or that skip verification, are not affected. If an endpoint CA Connector connects to uses one of these chains, install a certificate from a different CA.

SCM-15832

CA Connector now supports GlobalSign.

SCM-13814

CA Connector now supports EJBCA.

SCM-14520

Support for Entrust has been deprecated.

SCM-14886

The Manage CA permission for Microsoft CA is no longer required.

SCM-15548

CA connector v3.5

This release includes the following resolved issues:

Change Reference number

The Sectigo CA Connector 3.4 installer was reporting itself as 3.3.

SCM-13345

Discovery of certificates in DigiCert found no certificates if the account contained a multiple of 20 certificates.

SCM-13287

There was a missing space between review_requests and create_longer_validity_order when describing missing DigiCert API permissions.

SCM-11284

CA connector v3.4

This release includes the following updates and improvements:

General updates

Change Reference number

Added the ability to search MS CA for certificates with SCM 25.11.

SCM-13213

Resolved issues

Change Reference number

Connector no longer crashes when reconnecting to MS CA after disconnect event.

SCM-13210

CA connector v3.3

This release includes the following general updates:

Change Reference number

Improved handling of offline MS CA so that certificate management operations such as auto-renew will be retried automatically when the CA is online again.

SCM-11166

Improved permission check performed when adding Digicert backend so that missing permissions are not a fatal error. The missing permission is shown but the backend is added.

SCM-10283

CA connector v3.1

This release includes the following updates and improvements:

General updates

Change Reference number

Improved reconnection logic if MS CA returns 0x80010108 “The object invoked has disconnected from its clients” error.

SCM-8918

Resolved issues

Change Reference number

Fixed discovery of DigiCert to find SSL certificates.

SCM-9098

Fixed enrollment for DigiCert Flex SSL certificates.

SCM-9299