Orchestration gateway release notes

SOG can now discover and renew certificates on Palo Alto PAN-OS firewalls and Panorama through the PAN-OS management API. Certificate installations are committed automatically, and from Panorama they are pushed to member devices. No separate restart step is needed.

SCM-14774

SOG can now discover, enroll, renew, and install certificates on Akamai CPS. It works with existing and new CPS enrollments and supports RSA or ECDSA keys. The private key stays in Akamai CPS. SOG uploads the signed certificate, binds it to the Enhanced TLS edge hostname and activates the property. Endpoints are configured with EdgeGrid credentials, and requests can optionally go through the SOG proxy (use_proxy, default off).

SCM-14596

SOG’s WinRM client has been replaced with a more capable one that fixes intermittent "401 Invalid Content" and HTTP 400 and checksum errors; supports Basic, NTLM and Kerberos with message-level encryption, and no longer reports a false "restart failed" for successful Windows service restarts. When a WinRM connection fails, SOG now runs checks (connectivity, DNS, port, authentication, Kerberos) and adds specific recommendations to the error shown in the log and in SCM. It also provides improved support for WinRM configuration types.

SCM-15219 SCM-15114 SCM-15572 SCM-15279 SCM-14470 SCM-14577 SCM-14720 SCM-15400 SCM-15526

Proxy support in SOG has been improved. With the exception of HashiCorp Vault integration, proxy settings are now consistently applied. HashiCorp can only be configured using environment variables instead of the standard --use_proxy option when configuring the endpoint.

SCM-15411 SCM-15364

SOG can now manage Nginx with a non-root account over SSH or locally by running the Nginx commands through sudo. The account requires a sudoers entry for those commands and write access to the Nginx config location (root works as before).

Installing a certificate no longer restarts Nginx automatically.

The endpoint reports "Restart Required" and Nginx restarts only when SCM sends a restart command.

SCM-15514 SCM-15204

SOG can now add and discover Citrix ADC appliances that only offer older TLS ciphers, using the new use_legacy_rsa option on the Citrix endpoint, so initialization and node discovery no longer fail with the misleading "nsversion" error.

Citrix endpoints can also route traffic through the SOG proxy with use_proxy. Endpoint hostnames are now validated and supported schemes, ports, and paths are rejected with a clear validation method.

SCM-15372 SCM-15439 SCM-15511 SCM-14893

SOG can now discover and renew the certificate used by the F5 management interface (TMUI / iControl REST). The new certificate becomes active after an httpd restart, which you control with SCM’s "Restart After Installation".

F5 endpoints can also be added on a non-default management port with tls add f5 --port.

Each phase is logged by discovery.

SCM-13963 SCM-14062 SCM-15294

Cloudflare endpoints can now use the HashiCorp Vault credstore.

Cloudflare insecure mode now honors the proxy.

SCM-15019 SCM-15635

F5 discovery no longer hangs at 100% CPU, leaving the endpoint stuck in INIT, when a virtual server uses a profile whose certificate is a CA certificate (such as BIG-IP’s stock /Common/clientssl profile).

A virtual server with a malformed destination now returns an error instead of crashing the agent.

SCM-15391 SCM-14088

Certificate renewal now succeeds on IIS sites with several matching HTTPS bindings (for example a non-SNI binding plus an SNI binding on port 443).

Every matching binding is updated instead of the install failing.

SCM-15526

Discovery of large Imperva accounts is significantly faster (one keystore lookup per account instead of one per site) and no longer drives CPU to 100%.

SCM-15392

Syncing sites with long domain names using Imperva no longer fails in SCM, so all discovered sites appear in the node list.

SCM-15230

CyberArk credentials now work for discovery and enrollment, reported errors are clearer, and use_proxy is honored.

SCM-15420 SCM-15633

Resolved Apache Tomcat issues: Linux keystore permissions and restart-script launch; and removed false restart failures over WinRM.

SCM-15114 SCM-15087

Apache on RHEL 8.3 no longer fails to restart after certificate deployment.

SCM-13895

Restored and improved functionality that allows orchestration gateway to install certificates to discovered nodes that do not already have them. This applies to both HTTP and HTTPS nodes.

SCM-15115

A hostname longer than 39 characters would cause discovery to fail in the Imperva integration.

SCM-15161

New endpoints added to orchestration gateway:

SCM-13785 / SCM-14250

Proxy support added to external credential stores.

SCM-14258

New ability to configure an orchestration gateway to perform network discovery tasks in SCM.

SCM-14475

Add and edit orchestration gateway keystores and endpoints from the SCM UI.

SCM-14395 / SCM-14396

Implemented support of orchestration gateway cloud discovery.

SCM-14263

Added Imperva and Cloudflare support for WAF and CDN.

SCM-14382

Citrix install would fail when intermediate certificate already existed under a different certkey name.

SCM-14817

Orchestration gateway would rewrite Tomcat from legacy SSL model to modern model but preserved deprecated SSL attributes.

SCM-14841

Discovery error when using Apache server.

SCM-14732

Failure to update certificate profile when using Citrix Netscaler.

SCM-14761

Node information for orchestration gateway would show incorrect certificate path.

SCM-14823

There is now support for Imperva Web Application Firewall (WAF) Cloud as a new SSL/TLS automation endpoint.

Each Imperva endpoint represents an Imperva account. Sites in that account are discovered as nodes and the gateway installs custom certificates onto them via the Imperva REST API.

The Imperva API doesn’t support retrieving the actual certificate. As a result, when discovering certificates on existing sites, only metadata (such as fingerprint, serial number, and expiry) may be visible in SCM. Once a certificate has been deployed via SCM, the complete certificate will be visible.

SCM-14018/ SCM-14252

There is now support for NetScaler (formerly Citrix ADC) as a new SSL/TLS automation endpoint. This includes certificate automation for Content Switching vServers, Load Balancing vServers, Citrix Gateway, and Authentication vServers.

SCM-14261

There is now support for Beyond Trust Pathfinder Platform as a credentials store.

SCM-14262

An endpoint configured in Sectigo Orchestration Gateway could not be removed using the standard CLI command, and returned a “not found” error.

SCM-14548